Detection ownership includes maintenance
Writing a detection is the small part. Keeping it working is the job.
Log formats change, systems are replaced, the behaviour it watches for stops being used, and a rule nobody owns rots silently. A detection library with no named owners accumulates entries that have matched nothing for two years, and nobody knows whether that is good news.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- High fidelity and high coverage pull in different directionsOne screen, one setting
- Detections inherit telemetry blind spotsThe hole is copied too
- Detection names should describe behaviour, not certaintyName the behaviour
- Suppression is a security decisionThe tag on the switch
- Detection rules need regression testsRun the old cases again