Detection engineering
termsecurity
Treating each detection as an engineered artefact rather than a switch: a stated hypothesis, the data it requires, logic under version control, a test that proves it fires, a false-positive budget, a named owner and a documented response.
It is the difference between a platform that costs money and a capability that finds intrusions, and it is almost never in the purchase order - the product is a cost, the content is the capability. The load-bearing element is the documented response: an alert nobody knows what to do with is worse than no alert, because it consumes the attention a real one needs and teaches the team that the console lies. Detections without owners are eventually suppressed or ignored, and both look identical on a dashboard.
Also known as: detection as code, use case development, rule tuning, false positive budget