Kit · Engineering

Detection engineering kit

Detection content is an asset with a maintenance cost. This kit covers the lifecycle from hypothesis to retirement, the gate a rule must pass before it can wake anyone, and how to keep coverage claims honest.

Cadence: Weekly review
Gate: No rule without a response

All kits

The rule that has no response is not a detection

A rule that fires and leaves the analyst to work out what to do is not a detection — it is a notification with extra steps. Over a year, a handful of those will train the team to close alerts without reading them, and that habit will not distinguish between the noisy rule and the important one.

So the gate is simple and absolute: no rule reaches production alerting without a documented response action. If you cannot say what someone should do when it fires, it is not ready, and it may belong in a hunting query rather than in the queue.

Weekly tuning review

Thirty minutes, same slot every week. The point is not to reach zero false positives — it is to make sure noise is being decided about rather than absorbed.

Weekly

0/8

01Rank rules by alert volume for the week, and by false-positive rate.
02For each of the top offenders, take one of four decisions: tune, suppress with an expiry, accept with a named owner, or retire.
03Review suppressions expiring this week — do not let them roll silently forward.
04Check for rules that fired zero times: is that correct, or is the log source gone?
05Review escalations that L2 returned to L1 — those indicate a trigger that needs rewording.
06Add new detections from last week's incidents and threat intelligence to the backlog.
07Check backlog age: a stable backlog with rising age is worse than a growing one.
08Record every decision. Tuning without a record looks identical to neglect.

Four decisions for a noisy rule

Decision	When it is right	What it requires
Tune	The rule catches the right behaviour but the logic is too broad	A change record, a re-test, and a new volume estimate
Suppress	A specific known-benign source generates the noise	A scope as narrow as possible, and a hard expiry date — never open-ended
Accept	The noise is real but the coverage is worth more than the cost	A named owner, a stated rationale, and a review date
Retire	The technique is no longer relevant, or the rule never fires truly	A record of why, so nobody re-adds it in six months

Keep detection content outside the estate it protects

Version-control your detection logic separately from the environment it monitors, with authors, dates and application periods. It is both an operational safeguard — an adversary in the estate should not be able to read or edit what detects them — and the evidence that your detection engineering is a controlled process rather than console clicks.

Next kit

Environment onboarding kit

The step-by-step plan for bringing a new environment or log source under monitoring, and the verification that proves coverage is real.

Open Environment onboarding kit