Detection engineering and as code
Detection engineering is the art of building a detection approach and life cycle. It has many different names within the industry, from use case development to threat content development or detection content development. Even though there is no official definition of what detection engineering is, it seems that the community has adopted this terminology when it comes to developing detection rules. While the role of a detection engineer might be broader than just building detection rules (think about tuning and tweaking systems, developing tools, ensuring the quality of detections, and so on), we agree that it is one of its main focuses.
In this section, we will see the three main rule formats that are essential for a detection engineer to understand and master: SIGMA, YARA, and SNORT.
In the previous section, we saw the example of the HAFNIUM threat actor. We built queries using Splunk SPL, but obviously, we might have used other SIEM/log management...
