Engineering Detections

A detection is a hypothesis about attacker behaviour, expressed as a query, that a human will be paged for. Two properties decide whether it is worth deploying: does it fire on the behaviour, and does it stay quiet otherwise. Most rules fail the second test, and the cost is paid by whoever is on call.

When to Use

• Writing a new detection rule from a TTP, a sample, or an incident
• Reviewing or tuning an existing rule that is noisy or silent
• Converting threat intelligence into deployable detection content
• Assessing detection coverage against ATT&CK
• Setting up detection-as-code: repo layout, testing, CI, deployment

When NOT to Use