A Blueprint for Detection Engineering: Tools, Processes, and Metrics
summary
Walks through a concrete detection engineering pipeline: use Attack Range to spin up instrumented VMs, run Atomic Red Team atomics to generate labeled telemetry, store curated logs in Splunk Attack Data, author detections as versioned artifacts in Git, validate them with contentctl in CI/CD, and package deployable Splunk apps. Claims a measurable outcome: validation and explanation that used to take days–weeks now takes minutes, with metrics driven by MITRE ATT&CK coverage, test pass rates, and environment-specific simulation results.
AI-written summary · about
chapters (13)
- 0:00Introduction to detection
- 1:00The problem and origins
- 3:14Defining detection engineering
- 5:37Core components
- 7:23The engineering process
- 10:44Tooling and automation
- 14:25Implementing the process
- 16:43Simulation methodologies
- 21:00Data curation and testing
- 24:23Metrics and reporting
- 26:40Lifecycle and maintenance
- 29:42Lessons and maturity
- 33:18Resources and conclusion
related talks
29mDetection Engineering: Defending Networks with Purpose
30mDetection as Code: Detection Development Using CI/CD
47mDetection as Code: The Engineering-Focused Future...
38mHow I Learned to Stop Worrying and Build a Modern Detection & Response Program
57mBuilding a Modern Security Engineering Organization
35mThe Best Defense is a Great Offense: Leveraging Automated...
48mMITRE ATT&CK: The Play at Home Edition
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...