The Detection Engineering Life Cycle

In Chapter 1, we introduced the foundational concepts that will be referenced throughout this book. With this baseline knowledge, we can begin diving further into detection engineering (DE) and its practical implementation. This chapter will cover the DE life cycle to help you understand the purpose of each phase. We will also consider the inputs and outputs of each phase to see how the different phases interact with each other for a holistic approach to DE.

To begin, we’ll introduce the DE life cycle and its subcomponents. Figure 2.1 shows the life cycle as a flow chart to help you understand the order of operations:

Figure 2.1 – DE life cycle

The top section shows the six primary phases, each of which we will dive into at a high level in the following sections of this chapter. The phases operate in sequence, aligning with the order shown in Figure 2.1, with the Test and Investigate phases potentially...