Detection Engineering Extension - How it Works
The extension equips Detection Engineers with essential tools to effectively identify and refine detections, ensuring continuous improvement and optimal performance of a SOC’s detection capabilities. It also serves as a centralized system of record, maintaining an up-to-date overview of the organization's detection posture. Additionally, the solution enhances the feedback loop between analysts and Detection Engineering by streamlining the collection of detailed feedback directly into the Detection Library application.
Detection Engineering Guided Process Workflow
After you install the Detection Engineering extension:
From the APPLICATION RECORDS, click next to the Detection Library.
A workflow to create a New Record is displayed.
From the New Record window, select the desired flow for the detection library. The guided workflow is the recommended option.
- The guided process widget provides a step by step process guidance on the recommended steps a Detection Engineer should begin to think about the entire process from:
- Determining a Threat Model
- Define Scope
- Determine Required Log Sources
- Design Detection
- Test Detection Logic
- Optimize Detection Logic
- Stage Detection
- Craft Detection Runbook
- Deploy to Production
- Fill all the fields and check the Mark as complete checkbox to save the record.
The Detection Feedback tab tracks the history of how often this detection has been resurfaced and provides comments from SOC Analyst to Detection Engineers for future iterations and improvements in detections.
Click a record to look at the feedback provided by the SOC analyst. You can also add additional notes as additional research.
Click the Support tab for additional guidance on the stage where the guided process was last reviewed.
Detection Library Analyst Feedback
The Detection Library Feedback Applet is triggered when the Status of is set as Resolved. A SOC Analyst will be able to select from one of the out the box Detection Closure Codes by selecting the drop-down.
Toggling the Request for Review triggers an additional workflow. If no detection is found, create a new detection library record. If an existing detection is found, return the Detection library record. In this example, no detection is found and a new Detection record is created upon submitting feedback.
Click the Closure Code Explanation Table checkbox expands the text explaining the table of available closure codes.
The closure codes are provided as a best practice, and can be modified as necessary.
An empty feedback throws an error. Make sure the Detection Feedback Text box is filled.
Detection Engineering Dashboard
The Detection Engineering Dashboard provides useful metrics to the SOC Leadership. You can navigate to the dashboard from the DASHBOARDS tab.
