Detection Engineering: Sigma, Logs & ATT&CK Coverage

Detection engineering is the work of designing, building, testing, deploying and maintaining detection logic with software discipline: requirements, version control, reviews, automated tests and metrics. It differs from SOC triage, which handles existing alerts, and from threat hunting, which looks for activity no alert covers yet.

Sigma is an open, vendor-neutral YAML format for detection rules. A rule describes a log source and a detection block with selections, filters and a condition. Converters such as sigma-cli use processing pipelines and backends to translate it into the query language of a specific SIEM.

Store positive events the rule must match and negative events it must not match next to the rule, and run them automatically on every change. Then generate a harmless event on a lab machine you own, for example creating and deleting a test scheduled task, and confirm the alert arrives end to end.

Check the five layers in order: is the activity recorded at the source, does the event arrive in time, is it parsed into the field names the rule expects, is the logic correct, and can analysts act on it. Searching the raw index for a lab test event usually locates the broken layer quickly.

Correlation rules, added in Sigma version 2, refer to other rules by name and evaluate several events over a time window. Types include event_count, value_count and temporal ordering. Counting distinct user names per source address, for example, can reveal password spraying that single-event rules miss.

No. A tag says a rule is intended to detect a technique, not that it would. Honest coverage is reported in rungs: telemetry available, rule exists, rule tested in the lab, rule tuned in production, ideally weighted by the techniques that matter for your threats.