The Detection Engineering Life Cycle

In Chapter 1, we introduced the foundational concepts that will be referenced throughout this book. With this baseline knowledge, we can begin diving further into detection engineering (DE) and its practical implementation. This chapter will cover the DE life cycle to help you understand the purpose of each phase. We will also consider the inputs and outputs of each phase to see how the different phases interact with each other for a holistic approach to DE.

To begin, we’ll introduce the DE life cycle and its subcomponents. Figure 2.1 shows the life cycle as a flow chart to help you understand the order of operations:

Figure 2.1 – DE life cycle

The top section shows the six primary phases, each of which we will dive into at a high level in the following sections of this chapter. The phases operate in sequence, aligning with the order shown in Figure 2.1, with the Test and Investigate phases potentially...

Phase 1 – Requirements Discovery

The first task in the DE life cycle is to collect detection requirements. The Requirements Discovery phase can be initiated from multiple sources, as described here, and results in detection requirements, which will be passed onto the Triage phase for further evaluation. At a high level, we can analyze inputs and outputs for each phase. In this case, we have the following:

• Input: Findings from detection requirement sources
• Output: Detection requirement(s) with the details specified in the Characteristics of a complete detection requirement section

This section will outline various aspects of the Requirements Discovery phase, such as what a detection requirement should include and where those requirements come from. To start, we’ll examine the characteristics of a complete detection and provide a template so that you can gather such information in your organization. Then, we’ll dive into the sources that detection...

Exercise – understanding your organization’s detection requirement sources

The following questions will assist you in identifying how each of the concepts applies to your organization. If you do not work in a role or company that provides you with the information to answer these questions, choose a fictional company to use with this book. As this book progress, questions like these will help reinforce the concept that certain aspects of your DE program will be heavily influenced by organization-specific characteristics. Being able to take information about an organization and understand how it affects detection development is an important DE skill:

1. Review the detection requirement sources listed in the chapter. Which of these apply to your organization?
2. Do your current processes enable these stakeholders to easily submit new requirements? How can your processes be improved to increase participation?

By answering these questions regarding your organization...

Phase 2 – Triage

As the backlog for requirements increases, a Triage phase is required to identify what detection should be focused on next. The following are the inputs and outputs associated with this phase:

• Input: Detection requirement created during the previous phase
• Output: Triaged and prioritized detection requirement

In most circumstances, dependencies do not exist between detection requirements, allowing the DE team to choose the next appropriate task from the backlog. Using a first-in first-out queue or predefined priority is not preferable as these methods will not consider the changing external threat landscape and internal attack surface. In Chapter 10, we will review performance management techniques that influence the Triage phase. The Triage phase can depend upon several factors, including the following:

• The severity of the threat
• Your organizational alignment with the threat
• Your detection coverage
• Active exploits

...

Phase 3 – Investigate

The Investigate phase has multiple goals, but fundamentally, it needs to prepare a detection requirement for development by converting the detection requirements into more technical ones. Executing this process can identify deficiencies in intelligence or data collection, which will need to be resolved before development can start. The following are the inputs and outputs associated with this phase:

• Input: Triaged detection requirement
• Output: Detection of technical specifications and data engineering requirements (if applicable)

The Investigate phase can be broken into four steps:

1. Identify the data source
2. Determine detection indicator types
3. Research
4. Establish validation criteria

Let’s take a look.

Identify the data source

During this step, you must identify the relevant data sources needed to satisfy the detection requirement. Analysts will need to understand the intent and scope of the detection...

Phase 4 – Develop

The goal of this phase is to take technical specifications from the Investigate phase, then design, develop, and test a technical implementation for the relevant detection. The following are the inputs and outputs associated with this phase:

• Input: Detection of technical specifications
• Output: Detection code

As with most development work, this step requires rigorous planning. New detections need to not only satisfy the requirements but must also integrate with the rest of the detections within the environment. Detections are often implemented in the form of a query that is run against a data source or multiple data sources. Depending on your environment and its capabilities, different languages may need to interact with different data sources, and data pipelines and intermediary data stores may need to be built. The development process develops and implements a suitable solution for each new detection requirement, keeping both short- and...

Phase 5 – Test

Testing is a way to validate the efficacy of your detection and reduce its noisiness before deploying it within a production environment. While we show testing as occurring after development, in reality, it is a continuous process that occurs throughout the detection development process. It should not be relegated to occurring only after development is complete. A best practice within DE is to use testing to guide the development process.

Test-driven development is a software development technique that adapts well to this purpose. Tests are designed before development and are first added to the automated acceptance testing infrastructure. The development process starts with running the tests against your existing detection capabilities. This may result in you identifying already existing detection capabilities or confirming the failure of these tests, which identifies the need to create or update a detection. During the development process, these tests are...

Phase 6 – Deploy

The goal of this phase is to take the developed detection from the test environment and migrate it to the production environment. This detection is also monitored to ensure it runs as expected and does not negatively impact the performance of the production system. The following are the inputs and outputs associated with this phase:

• Input: Tested detection code
• Output: Deployed detection code

Deployment tags are a useful method for representing the maturity stages of a detection, enabling the rapid release of new capabilities while limiting the impact of a malfunctioning detection on analysts reviewing alerts. Here are the criteria for the experimental, test, and stable maturity stages:

• Experimental: At this stage, the detection has been designed and converted into code but extensive testing on its performance in a real environment has not been tested. Tweaking will likely need to be done for it to be ready before a peer review. The...

Summary

In this chapter, we introduced the DE life cycle and dove into its different phases. To break things down even further, we analyzed the inputs, outputs, and processes of that given stage in the life cycle. These phases will be the basis for the remainder of this book, and in subsequent chapters, we will dive into each of them.

The next chapter will take you through creating your own DE laboratory and the components found within the lab. We will also provide the technical details for investigating, developing, and testing new detections.