Unit 01 of 03
Detection Infrastructure
Builds the pipeline for the time between detection and containment: shift capacity and the case that fails to merge at the handover point, normalizing three log formats into a single schema and the field that cannot be mapped, the event a correlation rule merges and the one it misses, the question network flow data can answer without payload content, the threshold point where false positives and missed detections cannot be reduced at the same time, the number of techniques two rule versions cover, the item eliminated per hypothesis, the lifespan difference between indicator-based and behavior-based feeds, and automating repeated response.
Published Updated
Lessons
- 01 Security Operations Center 273 alerts falling on a fictional line are measured against a three-person shift: the day's work is 1,506 minutes, capacity is 1,440 minutes; the plan that splits twenty-four hours evenly leaves 64 alerts never reviewed and pushes the median wait to 222 minutes, while the plan that leans on density leaves eight hours uncovered and brings that down to 13 alerts and 83 minutes. 19 of 26 cases cross the handover point; with an empty handover note, 19 cases never merge and the median case decision is 987 minutes, dropping to zero unmerged cases at a six-item note with the median falling to 273 minutes, while at twelve items the handover eats 72 minutes and pushes never-reviewed alerts to 26. 13 min read
- 02 Log Aggregation and Normalization Three separately formatted fictional logs are normalized into a single schema, and the fields that do not map are counted: 15 of 24 source fields fit an eight-field schema, 9 remain unmapped; four schema fields are empty in the network-flow log, and none of the 404 records has an actor. The sources write the same event 1, 5, and 8 minutes later. Two lookup tables fill in the actor field: 115 of 139 control-plane records convert to an account, 24 do not convert; in a five-minute window, 190 of 404 flow records get an actor assigned, 212 stay empty, and at sixty minutes the assignment rises to 208 while ambiguous records jump from 2 to 39. Of 26 events that leave a trace in two sources, 21 get collected; in a one-minute window, none do. 14 min read
- 03 Security Information and Event Management A three-condition correlation rule runs against a fictional 3,083-record event stream: the rule produces 10 alerts, and these alerts merge 161 raw events, 16.1 events per alert. Three of five fictional campaigns are caught; one stays below the threshold, one never appears because its third step exists only in network flow. The funnel narrows from 3,083 records to 12 candidates, from 12 candidates to 10 alerts, from 10 alerts to 3 decisions, and takes 43 minutes from the first record landing. In the threshold, window and lag sweep, no setting brings in all five of the five campaigns; the best row is 4/5 and 1 false positive. 12 min read
- 04 Network Flow Data Four metadata-only metrics run against 2,979 fictional flow records: regular interval flags 7 pairs and 6 of them are meter transfer, exit ratio flags 23 and 22 of them are nightly backup, new destination flags 7 and 6 of them are a new work item, long session flags 6 and 5 of them are an admin session. All four of the fictional items get flagged, but 39 of the 43 total pairs are legitimate. Of ten questions asked against the same record set, 6 are answered from metadata alone; what was sent, which account did it, whether the request was accepted, and which process started it stay unanswered. If everything flagged were cut, 630 flows and 8.8 GB of legitimate work would stop. 12 min read
- 05 False Positives and False Negatives 20 of 900 candidate items are fictional, and the score distributions from four attributes overlap in the 37–88 band: that band holds 157 legit and 17 fictional items, and no threshold can separate the two at once. At threshold 40, false positive is 124 and missed is 1; at threshold 80, false positive is 1 and missed is 11; even at the threshold 70 that minimizes total error, 4 false positives and 4 missed remain. A daily budget of 144 analyst-minutes nails the threshold to 72: 16 alerts, 7 missed items, and 42 items reached. A fifth attribute narrows the band to 49–75 and to 15 legit and 7 items, pulling the budget threshold down to 66, but a zero-zero threshold is still nowhere to be found. 7 min read
- 06 Detection Engineering Two rule versions are compared on a fictional classification matrix with eight tactic columns and 26 technique rows: version 1's 6 rules cover 11 techniques but only 8 are firable, 15 techniques are never covered; version 2's 11 rules cover 24 techniques, 19 firable, never-covered drops to 2. Over 51 fictional samples, version 1 catches 10, version 2 catches 30; once the reason for a miss is separated out, no-rule drops from 32 to 3 while no-source rises from 4 to 11. An extra 220 minutes of writing work comes to 11 minutes per sample, daily false positive drops from 30 to 27, but review load rises from 360 minutes to 513 minutes. 12 min read
- 07 Threat Hunting Six hypotheses are run against a fictional telemetry set of 12,910 records, and the items eliminated per hypothesis are counted: h1 eliminates 12,906 records in three steps and leaves 4 items, h4 leaves 6 items in two steps, h3 leaves 283 items and becomes impossible to review; h2, h5, and h6 find no fictional item at all but write 370 items to the baseline. A total of 1,691 minutes of search finds two fictional items, 846 minutes per item; writing a rule cost 11 minutes per sample. Two of the six hypotheses convert into a rule because they stay under the daily ten-alert limit, and four exceed the limit or return empty. 9 min read
- 08 Threat Intelligence A fictional feed of 900 indicators and 12 behavior definitions is compared on the lifespan axis over a 90-day window: the median life of an address indicator is 5 days, a file hash 2 days, a name 15 days; a behavior definition's median life is 358 days. Of the 900 indicators added by the ninetieth day, only 72 are valid, 828 are dead. Of 60 fictional contacts, 5 match the indicator list, 28 have an indicator not yet on the list that day, and 27 have an indicator whose life has expired. Raising retention from 3 days to 90 days moves caught contacts from 2 to 5 while raising dead matches from 2 to 190 and review time from 36 minutes to 1,755 minutes. Behavior definitions catch 27 contacts and produce no dead matches; catch per item is 5.6 per mille against 2,250 per mille. 12 min read
- 09 Response Automation Eight recurring response procedures produce 158 items and 1,215 minutes of manual work per day; full automation cuts that to 281 minutes but brings 2.65 wrong automatic actions per day and a 457-minute cost, for a net gain of 477 minutes. Three procedures give a net negative under full automation: account lockout -4, address blocking -72, endpoint isolation -72 minutes. Human-approved mode gives a net gain of 715 minutes with zero wrong actions; selecting the best mode per procedure raises the daily net to 870 minutes, and the 3,120-minute write-up work is repaid in 4 days. When the cut legit work item's minute value is taken as 90, full automation drops to -60 minutes at a 1x wrong rate. 11 min read