Fraud and abuse detection wired into a SIEM

Card-testing and brute-force detection routed to on-call with a runbook attached to every alert.

Who it was for: A payments platform exposed to automated card-testing traffic.

The problem. Automated enumeration against payment endpoints is both a fraud loss and an availability threat, and it doesn't announce itself. Without detection it looks like ordinary traffic until the chargebacks arrive.

What I did. Built the log pipeline into the SIEM, then wrote detections for card-testing patterns, brute force and anomalous transaction behaviour. Tuned edge rate-limiting and bot controls to cut volume at the perimeter. Every alert routes to on-call with a runbook attached, so whoever is paged at 3am has the next step in front of them.

The result. Repeat attempts are caught as they start rather than reconstructed afterward, and response is a documented procedure instead of improvisation.