.svg)
BUILDING A DETECTION PRACTICE
AUTHOR /
IBRAHEEM UTHMAN
YEAR /
2024
FIND WHAT STRUCTURE HIDES
Attackers exploit gaps between tools, not missing features in one tool. Detection engineering starts by mapping what your logs actually capture versus what you assume they capture. Blind spots hide in DNS, identity providers, and CI pipelines more often than in the firewall.
I teach practitioners to inventory sources before writing rules. A detection on data you do not have is theatre.
RULES WITH CONTEXT
An alert without linked events forces analysts to search from scratch. Every rule should attach the raw logs that triggered it, the asset owner, and the last known good state. Context cuts triage time from hours to minutes.
Noise is a design failure, not an operator failure. Tune before you add another rule to the queue.
LAB FIRST, PROD SECOND
Replay attack traffic in an isolated lab before promoting rules to production. Practitioners learn faster when they can break things safely. Over 100 engineers have gone through this loop, most shipping a tuned detection within seven days.
The lab uses the same stack as production: Wazuh, Elastic, Suricata. Skills transfer directly.
MEASURE OUTCOMES
Track mean time to detect and mean time to triage, not rule count. A team with ten high-fidelity detections outperforms one with two hundred noisy ones.
Review false positives weekly. Each one is a lesson about what normal looks like in your environment.
