Detection Engineering
Security Telemetry Data Contracts
A telemetry data contract makes event meaning, fields, timing, populations, ownership, change, and failure visible so detections do not depend on undocumented assumptions.
Category
Detection Engineering
Practical guidance for detection engineering decisions and defensible security work.
65 resources
Resources in this category
Browse all resources
Detection Engineering
Using Attack Flow to Design Multi-Step Detections
Use Attack Flow to represent ordered, branching adversary behavior and place detection opportunities where evidence can distinguish progress, alternatives, and defensive interruption.
Detection Engineering
Why ATT&CK Technique Coverage Is Not Detection Coverage
An ATT&CK mapping shows relevance to adversary behavior; detection coverage requires local evidence, tested scope, healthy dependencies, a consumer, and explicit uncertainty.
Detection Engineering
The Stealth and Defense Impairment Tactics in ATT&CK v19
Use ATT&CK v19's Stealth and Defense Impairment tactics to reason about visibility degradation, while keeping tactic labels separate from proof of malicious intent or local coverage.
Detection Engineering
Migrating from ATT&CK Data Sources to Data Components
Understand ATT&CK Data Components as descriptions of security-relevant information, and migrate older Data Source mappings without mistaking taxonomy changes for deployed visibility.
Detection Engineering
Detection Portfolio Prioritization
Prioritize detection work by threat relevance, consequence, evidential feasibility, decision value, maintenance cost, and current uncertainty instead of chasing rule counts or matrix color.
Detection Engineering
Choosing an Analytic: Match, Threshold, Sequence, Graph, Baseline, or Risk Score
Choose a match, threshold, sequence, graph, baseline, or risk model by the security claim you need to support—not by which feature a platform makes easiest to deploy.
Detection Engineering
Detection Invariants and Adversary-Controlled Features
Learn to distinguish necessary behavior from details an adversary can cheaply change, without pretending that any invariant is universal or permanently observable.
Detection Engineering
From Threat Model to Detection Hypothesis
Move from a broad threat model to a falsifiable prediction about the evidence a particular behavior path should leave—and the ordinary explanations that could resemble it.
Detection Engineering
Detection Requirement Specification: A Theory and Template
A detection requirement is the reasoning that connects a threat concern to a consumer, observable evidence, a testable claim, and an honest boundary of coverage.