Practical guidance for detection engineering decisions and defensible security work.
67 resources
Relate users, sessions, devices, workloads, applications, and resources across changing identifiers without turning uncertain joins into false identity or causality.
Distinguish event, observation, ingest, and processing time so windows and sequences reflect behavior without hiding clock drift, delayed delivery, or late evidence.
A telemetry data contract makes event meaning, fields, timing, populations, ownership, change, and failure visible so detections do not depend on undocumented assumptions.
Use Attack Flow to represent ordered, branching adversary behavior and place detection opportunities where evidence can distinguish progress, alternatives, and defensive interruption.
An ATT&CK mapping shows relevance to adversary behavior; detection coverage requires local evidence, tested scope, healthy dependencies, a consumer, and explicit uncertainty.
Use ATT&CK v19's Stealth and Defense Impairment tactics to reason about visibility degradation, while keeping tactic labels separate from proof of malicious intent or local coverage.
Understand ATT&CK Data Components as descriptions of security-relevant information, and migrate older Data Source mappings without mistaking taxonomy changes for deployed visibility.
Prioritize detection work by threat relevance, consequence, evidential feasibility, decision value, maintenance cost, and current uncertainty instead of chasing rule counts or matrix color.
Choose a match, threshold, sequence, graph, baseline, or risk model by the security claim you need to support—not by which feature a platform makes easiest to deploy.
Learn to distinguish necessary behavior from details an adversary can cheaply change, without pretending that any invariant is universal or permanently observable.
