Building a Detection Engine Part 1 - What is it? | Medium

During my relatively short time as a Detection Engineer I’ve interacted with numerous Detection Engines and I’ve always wondered how these systems worked. Outside of a few open-source examples it’s a rather uncommon topic to discuss which was surprising to me given their importance. Well.. I’m a firm believer that in order to truly understand something you need to get your hands dirty and try and build it yourself. Welcome to the first part of an ongoing series where I attempt to build my own custom Detection Engine. While the term “Detection Engine” has no widely-accepted definition, I’ve come to see it as a system that inputs data, analyzes it, makes a decision, and then outputs an artifact, say an alert or notification. To expand further, a Detection Engine should also be able to: Every single Endpoint Detection and Response (EDR) tool uses Detection Engines to detect potential threats. Most will use a mix of Rule-based and more complex Machine Learning/Heuristics/Reputation based e

During my relatively short time as a Detection Engineer I’ve interacted with numerous Detection Engines and I’ve always wondered how these systems worked. Outside of a few open-source examples it’s a rather uncommon topic to discuss which was surprising to me given their importance. Well.. I’m a firm believer that in order to truly understand something you need to get your hands dirty and try and build it yourself. Welcome to the first part of an ongoing series where I attempt to build my own custom Detection Engine. While the term “Detection Engine” has no widely-accepted definition, I’ve com