https://nullthought.dev/tags/detection-engineering/Recent content in Detection-Engineering on null thøughtHugoen-gbMon, 13 Jul 2026 00:00:00 +0000https://nullthought.dev/posts/detection-engineering-understanding-alert-capacity/Mon, 13 Jul 2026 00:00:00 +0000https://nullthought.dev/posts/detection-engineering-understanding-alert-capacity/<h2 id="why">why</h2> <p><a href="https://nullthought.dev/posts/detection-engineering-what-matters-and-can-you-measure-success/">My last post</a> claimed that 3 things matter in a detection engineering program: coverage, quality, and capacity. In this post I want to spend some time exploring the last in more detail. Specifically, I want to introduce a method that can help us answer common questions that come up in this space. Some examples include:</p> <ul> <li>What total alert rate can the triage team handle?</li> <li>What expected alert rate is reasonable for deploying a new rule?</li> <li>What alert rate for an existing rule should trigger a review?</li> <li>How many triage analysts do we need?</li> <li>What is the payoff for automation?</li> </ul> <p>Having answers to these questions is important. A given capacity imposes an alert budget and there are material consequences to exceeding it. Examples include operational burnout, reduced efficacy and efficiency, and even complete functional collapse. While it is easy to handwave answers, we can do a lot better with a little effort.</p>https://nullthought.dev/posts/detection-engineering-what-matters-and-can-you-measure-success/Sun, 18 May 2025 00:00:00 +0000https://nullthought.dev/posts/detection-engineering-what-matters-and-can-you-measure-success/<h2 id="a-beginning">a beginning</h2> <p>I have been thinking lately about detection engineering. Specifically, I have been thinking about these two questions as they relate to a detection engineering program:</p> <ol> <li>What matters?</li> <li>Can you measure success?</li> </ol> <p>I am not sure I have a good answer to either of these questions yet and there isn&rsquo;t a lot of authoritative information out there. As far as I can tell, detection engineering is a somewhat specialised and relatively new field within cyber security. It seems like most organisations are doing their own thing and only sufficiently mature organisations appear to have dedicated detection engineering teams.</p>