Detections inherit telemetry blind spots
A detection can only fire on data you are collecting. Wherever the telemetry stops, so does the detection, silently.
The machines without an agent, the cloud service whose logs were never enabled, the network segment that is not being captured. Nothing reports an error; the rule simply never matches. This is why coverage questions have to start with the data rather than the rule, and why a tidy detection library can coexist with very little visibility.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- High fidelity and high coverage pull in different directionsOne screen, one setting
- Detection names should describe behaviour, not certaintyName the behaviour
- Suppression is a security decisionThe tag on the switch
- Detection rules need regression testsRun the old cases again
- Behaviour often outlives static indicatorsThe footprints, not the coat