DevSecOps Practice Hub

Threat Detection Engineering

Write, test and maintain detections mapped to attacker techniques.

AdvancedThreat DetectionOperations

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Monitor Detection engineering, SIEM, compliance evidence and incident response.

Overview

Detection engineering treats detections as code: versioned, tested against known-good and known-bad telemetry, and measured for coverage and false-positive rate.

Why it matters

Untested detection rules quietly stop matching after a log format or platform change.

How it works

  1. 01Rules are written in a portable format such as Sigma and stored in git.
  2. 02Rules are validated against recorded telemetry in CI.
  3. 03Coverage is tracked against MITRE ATT&CK techniques.

Common tools

SigmaElastic SecurityFalcoKubernetesAWSLinux

Implementation examples

yamlSigma rule skeleton
title: Suspicious kubectl exec into production podstatus: experimentallogsource:  product: kubernetes  service: auditdetection:  selection:    verb: create    objectRef.subresource: exec    objectRef.namespace: production  condition: selectionlevel: medium
Portable rule formats let one detection compile to several backends.

Best practices

  • Test rules in CI against sample telemetry.
  • Track false-positive rate per rule.

Common mistakes

  • Deploying vendor default rules and never tuning them.

Hands-on labs