A detection lifecycle with countable gates and a scored backlog.

detect is a working model for running a threat detection engineering program: eight lifecycle stages, a six-input score that orders the backlog, fifteen metrics, and a detection-as-code pipeline that enforces the whole thing in CI. Take all of it or take one piece.

8lifecycle stages

6scoring inputs

15metrics, defined once

11query languages out

8modules you can take alone

1data file behind all of it

What it is#

A detection engineering program turns threat knowledge into alerts an analyst can act on, and then keeps those alerts worth reading. detect covers that end to end: how a candidate enters the backlog, how it is ranked against everything else waiting, what has to be true before it reaches production, and when it is taken back out. It is written for detections kept as code in Sigma, converted to whatever query language your SIEM speaks, but the stages, the score, and the metrics work the same in a ticket queue.

What sets it apart#

A program that ships rules without a gate on the way in ends up in the same place everywhere: alerts nobody has time to triage, analysts who stop reading them, and a rule count that passes for progress. Detection lifecycle diagrams are easy to find; this one is built to be checked. Every stage exits on a number someone can verify, every score carries a line of evidence per input, and the whole framework lives in one JSON file that renders this site and gates a CI pipeline in the reference repository. A change to a gate changes the prose and the pipeline in the same commit.

Gates you can count

Each stage exits on a countable condition: fixtures passing, evidence lines present, days below the precision floor. "The rule is validated" fails review here; "N engine passes, N golden diffs, 1 approval" is the gate.

One file, two consumers

framework.json drives every page on this site and every lint rule in the repository. Prose and pipeline stay in agreement because both are generated from it.

A pipeline that runs

One Sigma rule converts to eleven query languages, fixtures replay against real engines, CI computes every score, and a hand-edited score fails the build.

Pick up one piece#

Each module stands on its own and has a version small enough to try this week. Using it at your size says what each one fixes, what it needs first, and who holds which role on a one-person team, a team of four, and a program of several teams.

Detection zeroAn afternoon for the first source, an hour for each one after The scored backlogAn hour to score ten candidates once the anchors are read Countable exit gatesOne editing session on your ticket template The detection recordThirty minutes per detection, most of it recall Second-engineer reviewTwenty minutes per detection for the reviewer Retirement triggers and the precision floorA scheduled query per month, plus one review of the results The metric setHalf a day to wire the first four; the rest as the data becomes available Detection as codeA week for the first pipeline, then minutes per detection

Explore#

Lifecycle mapInteractiveThe eight stages as a transit map. Tap a station for its purpose, gate, owner, artifact, and the mistake that stalls it. PrioritizeInteractiveScore a backlog by value against cost. Move the weights, watch the order change, export it. Start hereInteractiveThree questions that route a team to its first ten rules. MetricsInteractiveWhy rule counts overstate coverage, and the fifteen numbers a program reports. Using it at your sizeEight modules, what each one fixes, and who holds which role at one, four, or a dozen engineers. Read the frameworkEleven sections and four appendices, every table generated from the data file. DownloadsThe whitepaper as PDF, Word, and Markdown, and a scoring workbook for Excel, all CC BY 4.0.

The reference pipeline is a public repository: one CI job per gate, one Sigma rule in, eleven query languages out, fixtures replayed, a score computed for every rule, and ATT&CK pinned at the version the rules were checked against. The data behind every page is at /data/framework.json.