thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Detection Engineering

The discipline of designing, building, testing and maintaining threat detections as code.

Definition

Detection engineers translate threat intelligence and ATT&CK techniques into SIEM, EDR and network rules, version them in source control, test them against simulated attacks and measure their performance. Formats such as Sigma enable portable detections. It closes coverage gaps identified by threat hunting.

Example

Writing a Sigma rule for suspicious LSASS access and validating it with Atomic Red Team.

Exam tip

Detection-as-code with testing and ATT&CK mapping is the modern best practice.

Related terms