What Is Detection Engineering?
Detection engineering treats detections as an engineered product — designed, tested, documented, and maintained — rather than a pile of alert rules that accumulate over time. It is the difference between “we have hundreds of rules” and “we can reliably detect these specific attacker techniques, and we have proven it.” As attackers evolve, that rigor is what keeps a SOC effective.
What does detection engineering involve?#
The lifecycle mirrors software engineering:
- Identify what to detect — driven by threat models and MITRE ATT&CK techniques relevant to you.
- Build the detection against real log sources.
- Test it by emulating the actual attacker behavior and confirming it fires.
- Tune to cut false positives to a manageable level.
- Maintain — detections rot as the environment changes; they need upkeep.
Each detection is documented with the technique it catches and version-controlled, so the SOC’s capability is a known, measurable thing rather than a mystery pile of rules.
Why is this better than collecting rules?#
| Ad-hoc rules | Detection engineering |
|---|---|
| Untested — may never fire | Validated against real attacks |
| Unknown coverage | Mapped to ATT&CK, gaps visible |
| Noisy | Tuned for signal |
| Rot silently | Maintained deliberately |
Detection engineering is how modern blue teams build reliable detection. More at the Defense & Hardening hub.
Frequently asked questions#
What is detection engineering?
Detection engineering is the discipline of designing, building, testing, and maintaining detections for security threats as if they were software. Rather than accumulating vendor rules, detection engineers deliberately create detections mapped to real attacker techniques, validate that they fire correctly, tune out false positives, and maintain them as the environment changes.
How is detection engineering different from just writing SIEM rules?
It applies engineering rigor: detections are based on threat models and MITRE ATT&CK, documented with the technique they catch, tested against real attack behavior, version-controlled, and measured for effectiveness. Ad-hoc rule-writing produces a pile of untested alerts; detection engineering produces a maintained, measurable detection capability.