Introduction to performance management
We are using the term performance management in this chapter to describe the various knowledge and techniques we can use to identify how to most effectively improve the performance of our detection engineering program. In an ideal world, we’d detect all bad behavior and not flag any legitimate activity. There is, however, no magic solution that allows for that. As such, we need to know how and where our detection program and our detections are falling short.
This chapter will break down different aspects that we can assess to get a better idea of areas of improvement. We’ll be able to identify where issues exist that are causing our detection program or detection rules to underperform. With that knowledge in hand, we can slowly take steps to prioritize changes that will lead to improved performance and, over time, increase the maturity of our program.
We’ll start this chapter by giving you a way to assess the current...