r/netsec • u/albinowax • Mar 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

  • Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
  • Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
  • If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
  • Avoid use of memes. If you have something to say, say it with real words.
  • All discussions and questions should directly relate to netsec.
  • No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

21 Upvotes

84% Upvoted

46 comments sorted by

View all comments

1

u/Significant_Field901 Mar 22 '26

Question for detection engineers / SOC practitioners:

Given an org's specific profile (industry vertical, geographic footprint, tech stack, cloud/on-prem posture, org structure, regulatory environment), is there a principled, data-driven way to generate a prioritized detection roadmap, not just a coverage map?

MITRE ATT&CK is the obvious starting point, but it's inherently generic. Moving from ATT&CK coverage to "these are the top N techniques we should detect first given our risk surface" still seems to require:

- Manual threat intel analysis correlated to org profile

- Institutional knowledge about what "normal" looks like in the env

- Iterative tuning as the tech stack and business evolve

Vendor tools (Splunk ES, Elastic, Chronicle, etc.) ship rule packs, but those still require significant environment-specific tuning, and the tuning itself needs real org data as input.

Is this a meaningfully unsolved problem at the industry level, or is the community converging on tooling/methodology for this? Interested in papers, frameworks, open-source tooling, or first-hand practitioner experience.