Detection Engineering

Definitions

1. The practice of designing, testing, tuning, and maintaining detection logic so security tools can reliably identify malicious behavior. It treats detections like engineered products rather than ad hoc alerts, with versioning, validation, and feedback from real incidents.

   In plain English: Building and improving security detections in a disciplined, testable way.

   Example: "Detection engineering rewrote the old rules after they kept alerting on admin scripts and missing the real abuse."

Related Terms

• Anomaly Detection
• Behavioral Analysis
• Cyber Deception
• Extended Detection and Response
• Intrusion Detection System
• Log Correlation
• Security Information and Event Management
• Detection Rule
• Managed Security Service