MY SIEM-AGNOSTIC CREATIVE PROCESS TO DETECTION ENGINEERING

Summary from the TLDR InfoSec newsletter

This post describes a process for understanding a new data source and creating detections for malicious behaviors. The first steps involve reading the documentation to understand the service and brainstorming ideas for what a malicious user might do. Then, examine the logs to determine what is considered regular or anomalous behavior, often utilizing event counts. Finally, plan out what type of detection they will write, write the detection, and then test for success, failure, and edge cases.