Detection Research
The investigative work a detection engineer does to understand an attacker technique before building a detection, studying how it behaves, what telemetry it generates, and how attackers vary and evade it.
Concept Neighborhood
Explore this concept’s connections in the groups below.
Start here
Detection Hypothesis
Where Detection Research leads next, covered by 13 lessons.
Detection HypothesisStart here
A testable idea about how a specific attacker behavior would appear in available data, which a detection engineer forms before building a detection, stating what to look for and in which telemetry.
13
lessons
Detection Robustness
How resistant a detection is to evasion and to breaking, a robust detection keys on hard-to-change attacker behavior rather than superficial, easily altered indicators, so attackers cannot trivially bypass it.
7
lessons
Related Lessons
1 lesson covers this conceptSign in to open lesson content directly.