How One Team Built a Security Baseline Using Its Existing Elastic Stack in 3 Weeks

A software product company with 70–100 developers had cloud and Kubernetes infrastructure but lacked meaningful security visibility despite already running an Elastic/ELK deployment. The team had no consistent monitoring of failed authentications, RBAC changes, or suspicious container activity, and no defined process for responding to security incidents. Rather than adopting an expensive commercial SIEM, a consultant spent roughly three weeks building a right-sized security telemetry baseline using the existing stack. The project delivered prioritized detections, practical dashboards, and a lightweight incident-response workflow the DevOps team could own. The core takeaway was that security maturity can begin by making better use of systems already in operation, not by adding new tooling.