Detection Engineering Extension
Overview
The Detection Engineering Extension is a comprehensive suite of content components, including Playbooks, Applets, Applications, Reports, Dashboards, and more, designed to enhance the efficiency and effectiveness of detection engineering within a security program.
This extension equips Detection Engineers with the necessary tools to effectively identify, develop, and iterate on detections, ensuring the continuous improvement and optimal performance of a SOC's detection capabilities. Additionally, it provides a centralized system of record for the organization's current detection posture. The extension also bridges the feedback loop between analysts and Detection Engineering by facilitating the collection of detailed feedback from analysts directly into the Detection Library application.
Capabilities
- Centralized System of Record for Detection Use Cases within a SOC: A unified platform to maintain and manage all detection use cases, ensuring consistent documentation and easy access within the Security Operations Center (SOC).
- Guided Best Practice Detection Engineering Process: A prescribed workflow that provides a structured and efficient approach to detection engineering, ensuring adherence to best practices.
- Case & Incident Management Extension: An integrated extension that links analyst feedback from the Detection Library with relevant closure codes, streamlining the incident management process and ensuring a comprehensive feedback loop.
Use Cases
- Report on Detection posture to SOC Leadership
- Out-of-the-box dashboards provide insight to overall detection coverage
- Improve and Iterate detections
- Practitioners can build new detections using a best-in-class detection engineering process, to ensure coverage of new and emerging threats
- Track Security Incident closure codes
- Security Practitioners will be able to identify detection engineering-relevant closure codes, which are purpose-built to measure detection efficacy.
- Close Feedback Loop
- Close the feedback loop between the analyst and detection engineer by providing an interactive applet.