SANS Detection Engineering Survey: Detection Engineering Best Practices for Implementing a Threat-Informed Defense

It takes skilled people, and effective, efficient tools to make sure you can create, validate, and maintain detection signatures that will provide full coverage of real-world attacks while minimizing false positives and false negatives. In this paper, SANS Director of Emerging Security Trends John Pescatore analyzes data from our recent survey on the state of the practice in detection engineering to provide guidance about improving your capabilities in keeping up with rapidly changing threats.