// Archive
Defense engineering
Detection engineering, SIEM, threat-informed defense, and the tooling that keeps a blue team honest.
Categories
- NOT-002Threat-Informed Defense Is Detection Engineering, Minus the GuessingA detection built on a file hash lasts until the next build. One built on a technique costs the adversary something to route around. That's the whole argument.#threat-informed defense#ATT&CK#detection engineering5 min read
- NOT-001Most Alerts Are Noise. Design for That.A detection rule that fires 200 times a day and gets ignored isn't a detection — it's a decoration.#detection engineering#siem2 min read