Detection engineering

Correct — Detections become software: reviewable, testable, and reproducible.

Correct — You see who changed what, when — and revert a bad rule.

Correct — Write once, target Splunk, Elastic, Sentinel, etc.

Correct — It says which logs, and what pattern constitutes a match.

Correct — One rule compiles to Splunk SPL, Elastic DSL, KQL, etc.

Correct — Community rule sets and tool independence.

Correct — Validate against real telemetry, plus unit tests on sample logs.

Correct — Safe, ATT&CK-mapped tests exercise your detection coverage.

Correct — Detections ship like software, gated by checks.

Correct — Prove it fires on the bad and stays quiet on the good.

Correct — You can answer who changed a rule and revert regressions.

Correct — A generic rule may be noisy or silent against your specific logs.

Correct — Fluentd/Fluent Bit, Vector, Beats, cloud log exports.

Correct — One rule can span AWS, K8s, and endpoint logs when fields align.

Correct — Enriched events let responders triage without pivoting everywhere.

Correct — The central platform for detection and investigation.

Correct — e.g. a failed-then-successful login plus a new IAM grant = one incident.

Correct — Deliberately choose what to index vs cheaply store.

Correct — Isolate a host, disable a user, open a case — automatically.

Correct — Turns a runbook into automated, consistent action.

Correct — The pipeline pushes validated detections to the SIEM.

Correct — You cannot investigate what you did not retain.

Correct — A field a rule needs may be missing, so the rule never matches.

Correct — Alert when an expected source stops reporting.

Correct — Hypothesis-driven investigation beyond what alerts catch.

Correct — Hunts are structured around a testable idea, often ATT&CK-derived.

Correct — Detecting behavior forces attackers to change how they operate.

Correct — Detect the "how", not just the disposable "what".

Correct — Hunts feed the detection pipeline; findings become code.

Correct — Hunt the techniques you cannot yet detect.

Correct — Statistical deviation flags subtle compromise static rules miss.

Correct — You may discover you lack the telemetry to prove/disprove it.

Correct — You cannot hunt in data you did not collect or kept.

Correct — Humans find the unknown; the pipeline then automates it.

Correct — A hunt library becomes a program, not a one-off.

Correct — Hunting continuously feeds new, tested detections into the pipeline.

Correct — Acquire evidence, analyze, contain, and remediate.

Correct — Volatile data vanishes on power-off/termination.

Correct — Preserve evidence; termination discards it.

Correct — Untracked evidence can be challenged or worthless.

Correct — The primary timeline source for a cloud intrusion.

Correct — Contain the resource while preserving its state.

Correct — You see the sequence: initial access → escalation → persistence → impact.

Correct — A terminated instance and its volatile state are gone in seconds.

Correct — Attackers persist in the control plane, not just one host.

Correct — Manual response is often too slow before resources disappear.

Correct — A closed loop: each incident improves future detection.

Correct — Evidence integrity is an architecture decision.

Correct — A high-confidence tripwire with near-zero false positives.

Correct — Extremely low false-positive rate.

Correct — Placed where an attacker rummaging for credentials would find them.

Correct — The real alert drowns in noise.

Correct — Tune, dedupe, enrich, and prioritize.

Correct — Less noise, clearer signal.

Correct — Context turns an alert into an actionable one.

Correct — A structured map of prevent/detect gaps.

Correct — A core measure of detection program effectiveness.

Correct — Precision is essential to a usable detection program.

Correct — Precision improvements, not blanket disabling.

Correct — Outcomes and coverage, not raw activity.