Blue-Team Detection Engineering (DETECT)

Scope & Objectives

Invert the red-team view of this playbook into blue-team instrumentation requirements. Every other check module proves a vulnerability CLASS is exploitable; this module defines what must be LOGGED and what must ALERT so defenders see exploitation attempts (probes, bursts, error noise) and successful compromises (state changes, egress touches, deny-then-allow flips) for each of those classes.

Deliverables of an audit run with this module:

1. Coverage matrix scorecard — for each of the twelve classes (INJ, WEB, AUTHN, AUTHZ, SSRF, FILE, DESER, API, LOGIC, DOS, TOK, LLM), classify instrumentation as FULL / PARTIAL / BLIND using the matrix in Patterns & Signatures.
2. Detection-rule catalog — the concrete signals, log-line shapes, threshold starters, and false-positive pressures per class.
3. Pipeline-flow verdict — is the path app → log → shipper → store → alert → human intact, measured end to end.
4. Purple-team validation record — replay results proving each deployed detection actually fires (Exploitation & Reproduction).
5. Remediation package — emitter middleware, alert-config starter blocks, and runbook stubs sized to the team's stack.

Operating rules: