Detection Engineering

Operating Rules

• Start from a threat behavior, not a single IOC. Rules expire; behaviors persist.
• Every rule ships with: hypothesis, data source, ATT&CK mapping, false-positive notes, response action, and a test.
• Tune for analyst time, not raw event volume. A noisy critical is a broken critical.

Authoring Workflow

1. State hypothesis: actor, technique, observable, data source, confidence.
2. Identify telemetry: process, file, registry, network, auth, cloud, email, identity, EDR fields.
3. Draft rule in the platform's native DSL; keep selectors readable; comment non-obvious filters.
4. Generate matched and unmatched test events; run in a dry-run pipeline.
5. Validate with Atomic Red Team / Caldera tests; record true positive evidence.
6. Tune: add allow-lists with reasons and review dates; never silently broaden.
7. Ship with a runbook: triage steps, expected next queries, containment.

Coverage Strategy