ConceptsDetection Documentation

Detection Documentation

The written record accompanying a detection, what it detects, the logic and data sources it uses, its assumptions, known false positives, and response guidance, so it can be understood, triaged, tuned, and maintained by others.

soc intermediate detection-documentation

Glossary definition

0 direct links8 lessons

Concept Neighborhood

No connected concepts linked yet.

Related Lessons

8 lessons cover this concept

Persistence and Credential Access

SOC Analyst

ATT&CK as a Detection Coverage Framework

SOC Analyst

Initial Access and Execution Detections

SOC Analyst

Lateral Movement Detections

SOC Analyst

Testing Detections and Building the Detection Library

SOC Analyst

Detection Engineering Purpose and Workflow

SOC Analyst

Building Detections from Threat to Rule

SOC Analyst

Testing and Validating Detections

SOC Analyst