Glossary

Detection Development Cycle

The repeatable process of creating a detection from an attacker technique: research the behavior, write the detection logic, test it against the technique, validate coverage, document it, and deploy, often organized around the MITRE ATT&CK framework.