Treat Your Alerts Like Code (Detection Engineering)

Why this matters

Detection engineering treats alerts as code: each detection rule is versioned, tested, deployed, and measured for true/false positives. The mature team owns rule SLOs (time-to-detect, FP rate, MTTD) and ships new rules through the same pipeline as application code. The immature team has tribal knowledge in Splunk dashboards.

Demo

Pipeline: write rule in Sigma → translate to your SIEM via sigmac → unit-test against malicious + benign samples → deploy → monitor FP rate → tune. Each rule has an owner and an expiry date.

Try it yourself

1. Pick one ATT&CK technique relevant to your stack. Find the Sigma rule for it (github.com/SigmaHQ/sigma).
2. Translate the rule to your SIEM. Test against a sample log.
3. Set up FP-rate tracking. Most rules get retired or tuned within 90 days.

References

• Sigma rules
• Florian Roth — Detection Engineering