Tag - detection engineering

MITRE ATT&CK Framework: A Practical Guide for SOC Teams

You are already seated in the meeting, and the question before the group sounds simple: can the SOC detect a technique linked to a noisy intrusion path? Three analysts respond in three different ways because each is looking at a separate dashboard, a separate log source, and a separate mental model. The MITRE ATT&CK framework offers those people one common way...

Detection Engineering: Build Robust Programs & Best

Your SOC likely already has detections in place. The trouble is that many of them do not act like a managed security capability. They act like a stack of alerts. To protect their queue, analysts close noisy rules. Engineers continue adding logic because coverage gaps genuinely exist. Leaders ask if the program is getting better, and typical answers are weak. Alert...

Skip to content