Detection Engineering
Detection Engineering Studio: Correlation Without Drama
Program narrative
Each participant ships three detection drafts with unit-style tests against historical slices. We critique edge cases, duplication with existing content, and operational cost. Expect blunt feedback on alert volume projections.
What is included
- Rule test harness patterns
- Diff-friendly YAML layout examples
- False-positive postmortem outline
- Runbook snippet library
- Code review checklist for detections
- Canary rollout script for staged enablement
- Activity log reconciliation checklist
Outcomes you can evidence
- Publish detections with attached test evidence
- Estimate weekly alert volume with defensible ranges
- Pair with triage on rollback criteria before go-live
Course questions
Most examples use vendor-neutral pseudocode plus KQL and SPL snippets. You may adapt to your stack.
Cohort voices
The duplication audit caught two rules we never meant to ship twice. That alone justified the studio format.
Dense, fair, occasionally salty feedback on alert volume math.