Detection & SOC

Finding the thing. Telemetry, rules, and the gap between the two.

44 sketches

• IOCsWritten in ice
• SIEMOne hopper, and someone at the spout
• SOAROne card, every tool
• SOCThe screens are the scenery
• SOC automationOne stamp, ten thousand times
• Alert fatigueThe hand learns the shortcut
• Behavioural detectionNew shoes, same walk
• Detection coverageSix fitted, one rings
• Detection engineeringEvery detection needs a tag
• Log retentionThe month you no longer hold
• LoggingThe bucket that never moves
• Mean time to detectThe average is not the story
• Signal and noiseRight almost every time, and still mostly wrong
• Threat huntingA sentence, not a siren
• Threat intelligenceIt only counts if you turn
• Time synchronisationEverything happened
• TriageClosed on purpose, not by accident
• A log records an observation, not objective truthThe shadow, not the thing
• Central logging reduces local erasure riskIt left before you got there
• Verbose logging can leak secretsEverything, including that
• Retention determines how far back you can investigateThe line only goes back so far
• Telemetry coverage should map to detection questionsPoint it at the question
• Parsing errors can silently break detectionsSilence is not the same as clear
• High-volume logs can hide high-value eventsBuried by the ordinary
• Audit logs need protected accessIn only
• A detection is a hypothesis encoded as logicA guess you can run
• High fidelity and high coverage pull in different directionsOne screen, one setting
• Detections inherit telemetry blind spotsThe hole is copied too
• Detection names should describe behaviour, not certaintyName the behaviour
• Suppression is a security decisionThe tag on the switch
• Detection rules need regression testsRun the old cases again
• Behaviour often outlives static indicatorsThe footprints, not the coat
• Weak signals can correlate into a strong caseThree weak bearings
• Detection ownership includes maintenancePlanting is not the job
• Every alert should have an investigative next stepThe first stone
• Hunting starts with a question, not a dashboardBring a question
• Absence of evidence depends on coverageOnly the lit part was searched
• Hunts can become future detectionsLeave a bell on the path
• Threat intelligence should change a question or actionDid it move the points? Intelligence is useful when it changes what you ask or what you do
• Entity context turns events into investigationsThread the beads
• Baseline means understanding normal variationNormal is a band, not a line
• Hunt scope should be explicitPeg out the ground first
• A wrong hypothesis can still be usefulThe hole still tells you something
• Hunts need stopping criteriaA knot at the end of the line