Detection Engineering

The Detection Engineering poster, published by SANS Institute, provides a reference framework for building and operating a detection engineering program, covering the detection engineering life cycle, SIEM architecture planning, log collection and enrichment, and common detection techniques across email, DNS, HTTP, TLS, network flow, and user behavior. The poster was created by Kathryn Hedley, based on the research and knowledge of Nick Mitropoulos in authoring the SANS SEC555 course.

Key topics covered:

• Defines the detection engineering life cycle as six stages: Requirements Discovery, Triage, Investigation, Development, Testing, and Deployment
• Establishes seven criteria for evaluating detection requirements: coverage, durability, complexity, confidence, noise level, actionable content, and attacker cost
• Identifies three data collection strategies: input-driven (collect everything), output-driven (collect only what's needed), and hybrid
• Explains the "Collect, Aggregate, Store, Alert, Analyze" pipeline for turning logs into alerts
• Provides the EPS (Events Per Second) conversion formula: divide Events Per Day by 86,400
• Details four rule maturity tags for deployment: Experimental, Test, Production, and Deprecated/Unsupported (per Sigma rule statuses)
• Lists indicator types along a spectrum from Static (fastest to create, more tactical) to Statistical to Behavioral (most effort, fewest false positives, catches more advanced threats)
• Outlines fuzzy-searching techniques attackers use for domain look-alikes: character omission, insertion, replacement, transposition, and homograph attacks
• Defines fast flux detection markers: DNS TTLs under 300 seconds, response counts over 12, and persistent botnet callbacks
• States that Sigma rules require only three mandatory fields: title, logsource, and detection
• Notes NetFlow's 7-tuple design for flow monitoring, versus sFlow's packet-sampling approach
• Documents the MSSP selection process as five stages: define scope, draft an RFP, evaluate the MSSP, score and select, then onboard

The poster consolidates detection engineering practice into a single operational reference, moving the discipline from ad hoc rule-writing toward a repeatable life cycle with defined triage criteria, maturity tagging, and architecture planning. Its value is in giving SOC, threat hunting, and detection engineering teams shared vocabulary and criteria — from how to score a new detection request to how to tag a rule's production readiness — rather than leaving those judgment calls implicit. This is a technical reference poster (not a survey), created by Kathryn Hedley for SANS Institute drawing on the research and instruction of Nick Mitropoulos, author of SEC555: Cloud Security and DevSecOps Automation... (SEC555 — Detection Engineering).