Detection Engineering
Turn threat intelligence and incident findings into detection hypotheses and actionable rules.
This workflow helps detection engineers move from reports and CVEs to concrete hunt logic and detection improvements.
Detection Workflow
Hypothesis Building
- Identify likely attacker objective and execution path.
- Map expected TTPs and observable artifacts.
- Define minimum telemetry required to validate behavior.
Rule and Hunt Development
- Build one high-signal hunt query first.
- Add a narrower high-confidence detection rule.
- Add a lower-confidence analytic with suppression controls.
Prompt Pattern
bash
Given [CVE/actor/campaign], generate:
- likely execution and persistence behaviors,
- telemetry fields to query,
- one high-confidence detection idea,
- one hunt query for validation.
Quality Controls
- Rules include expected false-positive conditions.
- Hunt outputs are tied to specific response actions.
- Detections map back to known TTP coverage gaps.