Detection Engineering.

The discipline of designing, testing, deploying, and maintaining security detections as code, with measurable coverage of adversary techniques. It belongs to the Defense & Operations category of cybersecurity.

The discipline of designing, testing, deploying, and maintaining security detections as code, with measurable coverage of adversary techniques.

Detection engineering treats SIEM rules, EDR analytics, and threat-hunting queries like software: scoped by threat models, written from telemetry contracts, version-controlled, peer-reviewed, unit tested, and deployed via pipelines. Engineers map detections to MITRE ATT&CK techniques, document false-positive triage, set ownership, and track precision and recall over time. The practice replaces ad hoc tweaks in SIEM consoles with rigorous change management and reusable building blocks (parsers, lookups, content packs). Mature programs include backtests, breach-and-attack simulation, telemetry gap analysis, and retirement of low-value rules to keep the detection catalog healthy.

Defences for Detection Engineering typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Detection-as-code, DetEng.