Every alert should have an investigative next step
If nobody knows what to do when an alert fires, it will be closed rather than investigated.
An alert without an accompanying question to answer becomes a judgement call made under time pressure by whoever is on shift, and the judgement will trend towards dismissal. Writing the next step when you write the rule is what distinguishes a detection from a notification.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- High fidelity and high coverage pull in different directionsOne screen, one setting
- Detections inherit telemetry blind spotsThe hole is copied too
- Detection names should describe behaviour, not certaintyName the behaviour
- Suppression is a security decisionThe tag on the switch
- Detection rules need regression testsRun the old cases again