Detection Engineering
Detection engineering is the systematic discipline of creating, testing, deploying, and maintaining detection logic that identifies malicious or suspicious activity within an organization's environment.
What Is Detection Engineering?
Rather than relying on out-of-the-box detection rules from vendors, detection engineering takes a proactive approach to building custom detection capabilities tailored to an organization's specific environment, threat landscape, and risk profile.
The Detection Engineering Lifecycle
- Threat Research: Understanding relevant threats and adversary TTPs
- Data Source Identification: Determining what log data is available
- Rule Development: Writing detection logic (Sigma rules, YARA rules, SIEM queries)
- Testing & Validation: Verifying detections fire on real attack techniques
- Deployment: Pushing rules to production detection platforms
- Tuning: Reducing false positives and improving signal quality
- Monitoring: Ongoing review of detection performance
Key Principles
- Hypothesis-Driven: Start with a threat hypothesis, then build detection
- Data-Centric: Detection is only as good as the data feeding it
- Testable: Every detection should be validated against the technique it targets
- Maintainable: Rules should be version-controlled and documented
Common Detection Formats
- Sigma: Vendor-agnostic detection rule format
- YARA: Pattern matching for malware identification
- Snort/Suricata: Network intrusion detection rules
- KQL/SPL: Platform-specific query languages
