Building a Detection Engine Part 1 - What is it? | Medium

During my relatively short time as a Detection Engineer I’ve interacted with numerous Detection Engines and I’ve always wondered how these systems worked. Outside of a few open-source examples it’s a rather uncommon topic to discuss which was surprising to me given their importance. Well.. I’m a firm believer that in order to truly understand something you need to get your hands dirty and try and build it yourself. Welcome to the first part of an ongoing series where I attempt to build my own custom Detection Engine. While the term “Detection Engine” has no widely-accepted definition, I’ve come to see it as a system that inputs data, analyzes it, makes a decision, and then outputs an artifact, say an alert or notification. To expand further, a Detection Engine should also be able to: Every single Endpoint Detection and Response (EDR) tool uses Detection Engines to detect potential threats. Most will use a mix of Rule-based and more complex Machine Learning/Heuristics/Reputation based e

7 min read Jul 12, 2024 -- During my relatively short time as a Detection Engineer I’ve interacted with numerous Detection Engines and I’ve always wondered how these systems worked. Outside of a few open-source examples it’s a rather uncommon topic to discuss which was surprising to me given their importance. Well.. I’m a firm believer that in order to truly understand something you need to get your hands dirty and try and build it yourself. Welcome to the first part of an ongoing series where I attempt to build my own custom Detection Engine. What is a Detection Engine? While the term…

related reading

• What is Detection Engineering and Why do I Need it?cyberseccafe.com
• The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• Build for Detection Engineering, and Alerting Will Improve (Part 3) | by Anton Chuvakin | Anton on Security | Mediummedium.com
• Navigating the crossroads of Threat Hunting & Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• Mediumcyb3rops.medium.com
• Empowering Threat Detection With Custom Detections in EDRtruesec.com
• Focus Threat Intel Capabilities at Detection Engineering (Part 4) | by Anton Chuvakin | Anton on Security | Mediummedium.com
• detection-engineering-maturity-matrixdetectionengineering.io
• Table stakes for Detection Engineering - by Zack Allendetectionengineering.net
• Create custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learnlearn.microsoft.com
• Use customizable anomalies to detect threats in Microsoft Sentinel | Microsoft Learnlearn.microsoft.com
• Intrusion Detection | Computer Securitytextbook.cs161.org