FalconForce

FalconForce is a cybersecurity company based in the Netherlands that provides blue teaming and detection engineering services, along with offensive security testing. The company works with clients to design, implement, and maintain detection use-cases primarily built on Microsoft security tooling such as Microsoft Sentinel and Microsoft Defender for Endpoint (MDE/XDR). A core focus of FalconForce's work is detection engineering maintenance and tuning. The company develops and publishes tooling, such as FalconDash, an open-source Azure Workbook dashboard that helps security teams visualize detection trigger trends, identify noisy or degraded detections, and prioritize tuning efforts using entity mapping and time-series analysis. This tooling is built to integrate with Microsoft Sentinel data and can be extended with additional metadata sources such as ServiceNow ticketing data. FalconForce also publishes research and technical content through its "FalconFriday" series and Medium blog, covering topics such as detection logic, near-real-time (NRT) rules, EDR evasion techniques, and log manipulation. The company offers a managed service called Sentry Detect, referenced on its site under blue teaming services, aimed at helping organizations build and continuously refine detection content. The company's target audience includes enterprise security operations centers (SOCs) and detection engineering teams looking to reduce alert fatigue, improve detection reliability, and adopt more data-driven approaches to maintaining their security monitoring capabilities. FalconForce combines consulting/professional services with open-source tooling and software components to support its clients' detection and response programs.