Detection Engineering

Detection engineering is building, testing and maintaining the rules that find attackers in your logs. This roadmap suits SOC analysts ready to write detections. You need SIEM basics and a lab with logs.

• Have a lab SIEM with endpoint logs
• Know basic query syntax
• Plan your study time

• CyberA4U Academy — courses

Good detections follow a lifecycle: idea, research, development, testing, deployment, tuning and retirement. Frameworks like Palantir's ADS make each detection documented and reviewable.

• Describe each stage of the detection lifecycle
• Document a detection with the ADS framework
• Plan reviews and retirement

Tools & tech: Detection

• Palantir — Alerting and Detection Strategy framework

A detection is only possible if the right data is collected. Start from the technique, then find which data sources and fields reveal it.

• Map techniques to data sources using ATT&CK
• Identify missing telemetry
• Request specific log fields, not "all logs"

Tools & tech: Detection

• MITRE ATT&CK — Data sources

Mapping detections to MITRE ATT&CK shows which techniques you would see and where the gaps are.

• Tag detections with ATT&CK techniques
• Visualize coverage in ATT&CK Navigator
• Prioritize gaps by threat relevance

Tools & tech: Detection

• MITRE ATT&CK Navigator

Sigma is a generic, vendor-neutral rule format for log detections. Rules are converted to your SIEM's query language.

• Read and write Sigma rules
• Use log sources and modifiers correctly
• Convert rules to your SIEM

Tools & tech: Detection

• Sigma — Rules basics
• SigmaHQ rule repository

SIEMs use query languages such as KQL, SPL or Lucene. Fluency in one lets you explore data, write detections and investigate quickly.

• Filter, aggregate and join data
• Use time windows and thresholds
• Optimize queries for performance

Tools & tech: Detection

• Kusto Query Language (KQL) overview

Indicators (IPs, hashes, domains) are easy to change; behaviors are much harder for attackers to change. The Pyramid of Pain explains why behavioral detections last longer.

• Explain the Pyramid of Pain
• Convert an IOC-based detection into a behavioral one
• Know when IOCs are still useful

Tools & tech: Detection

• David Bianco — The Pyramid of Pain

A detection that fires too often gets ignored. Tuning uses allow-lists, context and thresholds without blinding the rule to real attacks.

• Measure alert precision
• Tune with narrow, documented exceptions
• Review exceptions regularly

Tools & tech: Detection

• Palantir — Alerting and Detection Strategy framework

Atomic tests are small, safe simulations of attacker techniques used to check whether a detection fires.

• Run Atomic Red Team tests safely in a lab
• Link each test to a detection
• Record results

Tools & tech: Detection

• Red Canary — Atomic Red Team

Detection-as-code stores rules in Git, reviews changes through pull requests, and deploys automatically — bringing software engineering discipline to detections.

• Keep rules in version control
• Use pull requests and peer review
• Deploy rules automatically

Tools & tech: Detection

• SigmaHQ rule repository

Continuous integration checks every rule change: syntax validation, conversion tests and replaying sample events so broken rules never reach production.

• Validate rule syntax automatically
• Test rules against sample events
• Block merges when tests fail

Tools & tech: Detection

• GitHub Actions — Quickstart

Threat intelligence tells you which actors and techniques target organizations like yours, so you build the detections that matter first.

• Read threat reports for relevant techniques
• Prioritize detections by threat relevance
• Track which intel led to which rule

Tools & tech: Detection

• MITRE ATT&CK — Groups

Endpoint telemetry — process creation, network connections, file and registry changes — is the richest source for detecting attacker behavior.

• Configure Sysmon or EDR telemetry
• Detect suspicious process chains
• Reduce noise with parent/child context

Tools & tech: Detection

• Microsoft Sysinternals — Sysmon

Identity attacks — password spraying, token theft, privilege escalation — are detected from authentication and directory logs.

• Detect password spraying and brute force
• Detect unusual privilege assignments
• Use identity protection signals

Tools & tech: Detection

• What is Microsoft Defender for Identity?

Cloud detections watch control-plane logs for risky API calls, new credentials and data exposure.

• Detect disabled logging and new access keys
• Detect public exposure of data
• Use managed findings as inputs

Tools & tech: Detection

• Amazon GuardDuty — Finding types

Purple team exercises test detections against realistic technique simulations and feed the results straight into new or improved rules.

• Plan tests with a red or purple team
• Record detected, partially detected and missed
• Turn misses into backlog items

Tools & tech: Detection

• MITRE CTID — Adversary Emulation Library

Over time detections break, go silent or become irrelevant. Regular review finds rules that never fire, always fire, or depend on missing data.

• Find silent and broken rules
• Retire or rewrite outdated detections
• Schedule periodic reviews

Tools & tech: Detection

Check that you can take a detection from idea to tested, documented, deployed rule.

• Identify telemetry and write a rule
• Test it with an atomic simulation
• Tune and document it

• CyberA4U CTF Arena — practice challenges

You can now engineer detections professionally. Continue with Threat Intelligence, Purple Team or Cloud Detection & Response.

• Keep your detection repository
• Choose your next roadmap
• Share a detection write-up

• CyberA4U CTF Arena — practice challenges