Preface

Greetings! Detection engineering as a practice intersects the best of security operational analytics, engineering, and research. What’s often left out is the automation life cycle of how the practice works with a globally distributed team at scale. There are many times when engineers who perform manual tasks, or administrative-burdensome items, can be greatly expedited by automation using DevSecOps principles. Automation is paramount to scaling the team and letting engineers focus on what they do best. The most effective automation comes in the form of a Detection as Code (DAC) program that incorporates three key principles:

• Research and engineering expertise
• Technology stacks that support integrations
• A “shift-left” mindset for work streams

There have been some publications and books that cover mainly the first principle. This book aims to extend the core skill and focus from only creating use cases to mastering the life cycle of the use cases through automation. This book will cover the best practices and advance your skills to implement an effective DAC program.

I’ll guide you through strategic planning, hands-on technical build-outs, and optimizations with AI augmentation, and monitor the program, drawing upon my direct experience as a detection engineer contributor and a director-level leader of people for multiple Fortune 500 enterprises. I also sought the input of respected industry leaders on their thoughts on an effective DAC program.

An industry-wide survey by the SANS Institute (https://www.sans.org/webcasts/sans-detection-engineering-survey/) in November 2023 suggested the best practices of a detection engineering team, which include automating development, deployment, and testing use cases. All these best practices lead back and align to a well-implemented DAC program. As an industry trend, we can expect the demands of security programs to increase and, by extension, our efficiency in detection engineering. Enterprises that carve resources for a detection engineering team will need to deploy DAC as part of their program strategy to keep the team efficient and effective.