# What is Detection Engineering?

> Detection engineering is the disciplined process of designing, testing, deploying, and maintaining ways to identify suspicious or harmful activity.

- Canonical URL: https://yellowcube.eu/glossary/detection-engineering/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It starts with a threat, abuse case, or defensive objective, identifies the evidence that activity would leave behind, and turns that reasoning into analytics that can be validated against realistic data.

The work continues after a rule goes live. Engineers monitor its performance, tune it as systems and adversary behavior change, document its assumptions, and retire it when it is no longer useful. A healthy program also finds telemetry gaps: a theoretically sound detection cannot work when the required events are missing, late, malformed, or inaccessible.

### Key points

- **Typical lifecycle:** Define the behavior, map required data, build the analytic, test expected and unexpected cases, deploy safely, measure, tune, and maintain.
- **Common inputs:** Threat intelligence, incident findings, adversary techniques, architecture knowledge, baseline behavior, and the organization’s own risk priorities.
- **Useful evidence:** Reproducible tests, known data dependencies, version history, ownership, investigation guidance, and recorded reasons for tuning or suppression.
- **Important limitation:** More rules and broader ATT&CK coverage do not automatically mean better detection. Poorly tested analytics can create noise, blind spots, or false confidence.

### Related terms

[Security telemetry](<https://yellowcube.eu/glossary/security-telemetry/>) · [Alert triage](<https://yellowcube.eu/glossary/alert-triage/>) · [Threat hunting](<https://yellowcube.eu/glossary/threat-hunting/>) · [Security information and event management (SIEM)](<https://yellowcube.eu/glossary/security-information-and-event-management/>) · [MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)](<https://yellowcube.eu/glossary/mitre-att-and-ck-adversarial-tactics-techniques-and-common-knowledge/>)

### Sources

[MITRE ATT&CK Detection Strategies](https://attack.mitre.org/detectionstrategies/) · [NIST Cybersecurity Framework 2.0](https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.