TELEMETRY · SIGMA · MITRE ATT&CK

Detection Engineering Starters

Start useful detections with known data sources, clear behavior hypotheses, Sigma-style logic, and honest MITRE ATT&CK mapping.

Start with a behavior and a data source, then build a detection you can explain, test, tune, and map honestly to ATT&CK.

PHASE 01

Choose observable behavior

Good starter cases include unusual privileged logins, new persistence, suspicious child processes, cloud key creation, and impossible travel review.

  • State the attacker behavior in one sentence.
  • Confirm the required telemetry exists and is retained.
SOC Alert Triage →

PHASE 02

Write Sigma-style logic

Keep selection criteria, filters, and condition readable. Describe false-positive sources before sending the rule to production.

  • Use stable fields, not vendor-specific labels alone.
  • Add a test event and expected match result.
Active Directory Security Checklist →

PHASE 03

Map and tune responsibly

Map to ATT&CK only when the observed behavior supports the technique. The mapping describes behavior, not attacker certainty.

  • Document data gaps and evasion limits.
  • Review precision, recall, and analyst time after deployment.
Incident Response Playbooks →

Frequently asked questions

Is MITRE ATT&CK a detection rule library?

No. It is a behavior framework. Use it to organize coverage, then create rules for the telemetry and risks you actually have.