Services · Defend
Detection engineering
We write detection rules as code, test them before they go live and maintain them afterwards, so you know what each rule is for and which ATT&CK techniques it covers.
What it covers
- A review of your current detection coverage against MITRE ATT&CK
- Rules written in Sigma and in your SIEM’s own query language
- Testing against sample events and your historical data before deployment
- Tuning to cut false positives without losing the behaviour a rule is meant to catch
- Version control, peer review and documentation for every rule
- Retiring rules that no longer earn their place
How an engagement runs
Review coverage
We map the rules and data sources you have against ATT&CK and show where the gaps are.
Prioritise
We agree with you which gaps to close first, based on your environment and the threats that matter to you.
Write and test
Each rule is written as code, reviewed by a second engineer and tested before it goes live.
Deploy
Rules go live through a change process you agree, so nothing reaches production unannounced.
Maintain
We revisit rules as your environment changes, tune noisy ones and retire those that no longer help.
What you receive
- Rules in a version-controlled repository
- Documentation for each rule: purpose, data source, ATT&CK mapping, test case and triage guidance
- An updated coverage map
- A change log of every rule added, tuned or retired
Talk to us about detection engineering.
Tell us about your environment and what you need covered, and we will talk you through how it would work for you.