Detection engineering as an explicit discipline

Why this matters

Detection engineering treats alerts as code: each detection rule is versioned, tested, deployed, and measured for true/false positives. The mature team owns rule SLOs (time-to-detect, FP rate, MTTD) and ships new rules through the same pipeline as application code. The immature team has tribal knowledge in Splunk dashboards.

Demo

Pipeline: write rule in Sigma → translate to your SIEM via sigmac → unit-test against malicious + benign samples → deploy → monitor FP rate → tune. Each rule has an owner and an expiry date.

Try it yourself

1. Pick one ATT&CK technique relevant to your stack. Find the Sigma rule for it (github.com/SigmaHQ/sigma).
2. Translate the rule to your SIEM. Test against a sample log.
3. Set up FP-rate tracking. Most rules get retired or tuned within 90 days.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain detection-engineering-as-code.

2. Why it works (the mechanism)

Walk me through a Sigma rule from authoring to production deployment.

3. Advanced — application & what's next

Design SLOs for a detection engineering team — what's a good MTTD target?

References

• Sigma rules
• Florian Roth — Detection Engineering