Users, Engineers & Operators

Building a team for modern SIEM and Observability tools

Our blog “2025 observations and 2026 predictions” highlighted platform ownership and management as an area we’ve seen continue to grow over the last 12 months. We have spoken with several organisations who have built out logging and monitoring platforms over a period of years. Often the growth has been organic, with platform use growing beyond the initial platform sponsor to multiple user groups. The initial sponsor loses visibility on exactly who is using the platform and how. The growth is not underpinned by a robust operating model, and as costs rise and scrutiny on the platform increases, it becomes clear that evidencing the value of the platform is now problematic.  

At this stage, customers identify that to get the best out of SIEM and observability platforms, it is key to bring together the roles of the users of the platform, the engineers who build content on the platform to constantly improve it for the users, and the operators who monitor and manage the underlying platform. When combined with expert consultancy to help architect and transform the overall solutions, organisations create a clear vision of how to keep their SIEM and observability platforms well managed, relevant to the needs of the business and providing the right answers to the operational teams. This can be illustrated as a venn diagram, with each of the 3 areas interacting, as illustrated below, to deliver the required value to the user community. 

 

 

 

The 3 components each have distinct areas of responsibility, coming together to ensure that the platforms consistently deliver value to the business:

 

1. Platform Operation = This is the foundation of ensuring that the platform is monitored, managed and kept doing what it should be. The biggest weakness of these platforms is that they fail silently, with issues sometimes only noticed when business operations are impacted. Good platform operation turns reactive troubleshooting into proactive maintenance. By constantly monitoring key health indicators it alerts to impending issues, and the impact this may have on the user community.  

2. Platform Engineering = With the operate service ensuring the platform is running correctly, engineering attach continually responds to user requirements, and engineering tasks highlighted by the Operate service, to ensure that the content of the platform is kept relevant and up to date. This ensures that users have at their fingertips exactly what they need to complete their roles.  

3. Professional Services = The role of PS is to support the overall platform with specific projects, architectural changes and strategic decisions. Organisations may need to expand their platforms due to business merger, may wish to look at new data pipelining approaches, or even consider migration to a new tool, among many other scenarios. Professional Services are able to help plan, design and deliver against such initiatives. 

 

To find out more about how we’re delivering this vision for our customers, visit our website pages to understand more about our Operate services.