Detection engineering
Detection engineering is the work of designing, testing, and maintaining security analytics that identify suspicious behavior from available evidence.
From suspicious behavior to a useful alert
Detection engineering starts with a behavior worth investigating, such as an unusual account-recovery sequence. Engineers find the records that could reveal it, write detection logic, and test the result. Telemetry is the events and other observations collected from systems.
MITRE’s workflow covers understanding the behavior, checking whether it is observable, choosing signals, adding context, validating the analytic, and assessing coverage. An ATT&CK mapping helps describe a rule, but testing shows what it can actually detect.
Check the data before blaming the rule
For an alert that combines a recovery-method change with an unusual sign-in, first check that the records can be linked reliably by account and time.
If both records arrive during an approved test but no alert appears, inspect the matching logic, processing delay, and routing. If a record never arrives, investigate collection too.
Test normal activity as well
Use representative suspicious cases and legitimate recovery activity. Check what triggers, what gets missed, and whether the alert gives an analyst a reason to investigate.
A false positive is benign activity incorrectly flagged. Excluding noisy activity can help, but an exclusion may also hide something important.
Give the rule and its data dependencies an owner. Repeat the relevant tests when logging, application behavior, or the rule changes. Check collection, alert generation, and response separately.