Detection Engineering

What is detection engineering?

Detection engineering is the practice of designing, building, testing and maintaining the rules and analytics that spot attacker activity in security data. It treats detections like software: each one has a purpose, a test, an owner and a version history, instead of being a one-off rule someone wrote years ago.

It is the point where threat intelligence turns into protection. Intelligence describes how attackers operate; detection engineering makes sure the SOC would notice if they did.

How does detection engineering work?

Choose what to detect. Start from the techniques your likely attackers use, mapped to MITRE ATT&CK. See intelligence-driven threat modeling.
Confirm the data exists. A detection is only as good as the logs behind it.
Write the logic against a normalized schema, so it covers every relevant source.
Test it against recorded attack activity and normal activity, to check it fires when it should and stays quiet when it should not.
Deploy and measure true and false positive rates.
Maintain it as data sources, attacker techniques and the environment change.

What is detection-as-code?

Detection-as-code means keeping detection rules in version control, reviewing changes like code and testing them automatically before deployment. Open formats such as Sigma, a vendor-neutral way to write detection rules that can be converted to many SIEM query languages, make detections portable between tools.

Why does detection engineering matter?

It closes the gap between what threat intelligence knows and what the SOC can see.
It reduces false positives, because every rule is tested and measured. See false positive reduction.
It makes coverage visible, so leaders can see which attacker techniques are and are not detected.
It keeps detections working through SIEM changes and data source changes.

Frequently asked questions

Who does detection engineering?

Dedicated detection engineers in larger teams, or senior SOC analysts and threat hunters in smaller ones. It works best in close contact with the CTI team.

How is detection engineering different from threat hunting?

Threat hunting searches for attackers who evaded existing detections. Detection engineering turns what hunters and CTI learn into lasting, automated detections.

Anomali and Detection Engineering

Anomali pairs out-of-the-box detections with threat intelligence and ATT&CK mappings, giving detection engineers curated context to build and prioritize detections.

See out-of-the-box detections or request a demo.