Detection Engineering 101
Telemetry sources, from log to alert, why Sysmon + Sigma matter, and how to measure detections by coverage and fidelity instead of rule count.
Detection engineering is building, testing, and tuning the rules that turn raw telemetry into actionable alerts, treated as a software discipline with version control, tests, and metrics.
It starts with telemetry
You can only detect what you collect. On Windows, Sysmon provides rich events, process creation (EID 1), network connections (EID 3), CreateRemoteThread (EID 8), and LSASS handle access (EID 10). On the network, Zeek and Suricata add flow and signature context.
From log to alert
- Collect telemetry from endpoints and the network into a SIEM.
- Write a detection, ideally in Sigma so it's portable across SIEMs.
- Test it against real attacker activity, not just a unit test.
- Tune to cut false positives, then track its fidelity over time.
Measure coverage, not rule count
A thousand rules that all watch the same technique is not coverage. Map detections to ATT&CK and measure the share of techniques you catch (coverage), how many alerts are real (fidelity), and how fast they fire (MTTD).
Stop reading. Start detecting.
Try the interactive kill chain in your browser, no signup, then run the real range.
Next module
Credential Access & Lateral Movement