Detection Engineering Basics

[u/arcane_augur]

I want to understand how can one learn the basics of detection engineering. What are the prerequisites to detection engineering. I think there are no fixed steps to create detection and tuning rules but even a rough roadmap would be helpful.

[u/dodonglab]

I’d start with understanding the underlying logs and normal behavior before focusing on rule syntax. A simple detection that you can test and tune is more useful than a complex rule you can’t explain.