You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -14,20 +14,77 @@ A centralized repository for building, governing, validating, and reporting on a
14
14
This repository serves as a one-stop location for:
15
15
16
16
- detection engineering strategy and program documentation
17
-
- executive proposal and maturity reporting
18
17
- detection-as-code content for Microsoft Sentinel
19
-
-governance, validation, tuning, and lifecycle standards
18
+
- validation, tuning, and lifecycle governance
20
19
- ATT&CK and Cyber Kill Chain coverage tracking
21
20
- analyst triage guidance and operational support
21
+
- executive reporting, planning, and maturity development
22
22
- future multi-platform expansion, including Splunk
23
23
24
24
---
25
25
26
26
## Purpose
27
27
28
-
Detection engineering is more than writing alert logic. A mature program requires structure, governance, testing, reporting, and repeatable workflows that turn threat hypotheses into reliable, supportable analytics.
28
+
Detection engineering is more than writing alert logic.
29
29
30
-
This repository is designed to support that full lifecycle.
30
+
A mature program requires structure, repeatable workflows, quality standards, validation, operational triage support, and reporting that connects technical content to program outcomes. This repository is designed to support that full lifecycle, from idea to validated analytic to operational use.
31
+
32
+
---
33
+
34
+
## Current Focus
35
+
36
+
This repository is currently centered on **Microsoft Sentinel detection engineering** and is being actively refined into a more governed, scalable detection engineering program.
37
+
38
+
Current priorities include:
39
+
40
+
- improving detection quality and consistency
41
+
- standardizing rule schema and metadata
42
+
- reducing duplicate and overlapping analytics
43
+
- strengthening analyst triage guidance
44
+
- improving ATT&CK alignment and lifecycle discipline
45
+
- organizing content for long-term maintainability
46
+
47
+
Planned future growth includes:
48
+
49
+
- expanded automation and validation workflows
50
+
- stronger deployment and reporting pipelines
51
+
- additional platform support such as Splunk
52
+
- shared governance and reporting across security platforms
53
+
54
+
---
55
+
56
+
## What This Repository Contains
57
+
58
+
### Detection Content
59
+
Detection content is organized as code and grouped by tactic under `detections/sentinel/`.
60
+
61
+
Current tactic areas include:
62
+
63
+
- browser
64
+
- collection
65
+
- command-and-control
66
+
- credential-access
67
+
- defense-evasion
68
+
- discovery
69
+
- execution
70
+
- exfiltration
71
+
- impact
72
+
- initial-access
73
+
- lateral-movement
74
+
- persistence
75
+
- privilege-escalation
76
+
- reconnaissance
77
+
- resource-development
78
+
- deprecated
79
+
80
+
### Triage Guides
81
+
Analyst-facing triage content is maintained under `content/triage-guides/` and is intended to support consistent investigation, escalation, and response.
82
+
83
+
### Governance
84
+
Governance content defines the standards used to maintain quality and consistency across the repository, including naming, severity, lifecycle, tagging, and rule quality expectations.
85
+
86
+
### Program Documentation
87
+
The `docs/` structure supports executive communication, strategy, process, reporting, and visual program artifacts.
31
88
32
89
---
33
90
@@ -70,145 +127,111 @@ Use these resources for investigation, escalation, and operational alignment:
70
127
71
128
---
72
129
73
-
## Repository Map
130
+
## Detection Content Cleanup and Standardization
74
131
75
-
-`docs/` — executive artifacts, strategy, process, visuals, and reporting
76
-
-`detections/` — detection content managed as code
77
-
-`content/` — templates, triage guides, and reusable operational content
78
-
-`governance/` — naming, severity, lifecycle, tagging, and quality standards
79
-
-`coverage/` — ATT&CK and Cyber Kill Chain coverage tracking
80
-
-`automation/` — scripts, schemas, and deployment helpers
81
-
-`tests/` — validation support and testing references
82
-
-`.github/` — workflows, templates, and contribution support
132
+
The Sentinel detection catalog has undergone a broad cleanup and normalization effort to improve quality, consistency, and maintainability.
133
+
134
+
This work included:
135
+
136
+
- reviewing rules for duplicate titles and duplicate IDs
137
+
- identifying overlapping or near-duplicate analytics
138
+
- cleaning up inconsistent metadata and ATT&CK mappings
139
+
- improving weak or overly broad logic
140
+
- converting older or package-style rules into a more consistent repository schema
141
+
- aligning detections with stronger triage guidance
142
+
- separating foundational broad analytics from narrower companion detections
143
+
- retaining stronger modern rules while retiring or demoting weaker legacy duplicates
144
+
145
+
This effort covered content across all major Sentinel tactic folders, including:
146
+
147
+
- collection
148
+
- command-and-control
149
+
- credential-access
150
+
- defense-evasion
151
+
- discovery
152
+
- execution
153
+
- exfiltration
154
+
- impact
155
+
- initial-access
156
+
- lateral-movement
157
+
- persistence
158
+
- privilege-escalation
159
+
- reconnaissance
160
+
- resource-development
161
+
162
+
### Resulting Improvements
163
+
164
+
Key outcomes of this cleanup include:
165
+
166
+
- cleaner rule placement by tactic
167
+
- fewer duplicate and near-duplicate detections
168
+
- more consistent schema and metadata
169
+
- improved ATT&CK alignment
170
+
- stronger triage and validation sections
171
+
- clearer lifecycle progression from experimental to production
172
+
- better separation between active, specialized, and deprecated content
83
173
84
174
---
85
175
86
-
## Executive Documents
87
-
88
-
Core program artifacts are located in [`docs/executive/`](docs/executive/):
Triage content has also been reviewed and expanded to better support analyst workflows.
98
179
99
-
This repository is currently centered on **Microsoft Sentinel detection engineering** and is structured to mature into a broader, multi-platform detection engineering program over time.
180
+
Updated guides are being rewritten into a fuller analyst-playbook style that emphasizes:
100
181
101
-
Planned future growth includes:
182
+
- why the alert matters
183
+
- what the detection is looking for
184
+
- initial triage questions
185
+
- key fields to review
186
+
- step-by-step investigation guidance
187
+
- common benign explanations
188
+
- escalation criteria
189
+
- response actions
190
+
- analyst notes
102
191
103
-
- expanded automation and validation workflows
104
-
- stronger deployment and reporting pipelines
105
-
- additional platform support such as Splunk
106
-
- shared governance and reporting across security platforms
192
+
This is intended to improve operational consistency and make the repository more useful to analysts, responders, and detection engineers alike.
107
193
108
194
---
109
195
110
-
## Detection Content Cleanup and Standardization
111
-
112
-
This repository recently underwent a broad cleanup and normalization effort across the Microsoft Sentinel detection catalog and supporting triage content.
113
-
114
-
### What was updated
115
-
116
-
- reviewed Sentinel detections across all major tactic folders for:
117
-
- duplicate titles
118
-
- duplicate IDs
119
-
- overlapping or near-duplicate analytics
120
-
- outdated schema formats
121
-
- inconsistent metadata
122
-
- weak or overly broad detection logic
123
-
124
-
- standardized detection content into a more consistent Sentinel-friendly schema, including fields such as:
125
-
-`platform`
126
-
-`query_language`
127
-
-`severity`
128
-
-`risk_score`
129
-
-`data_sources`
130
-
-`triage`
131
-
-`validation`
132
-
-`lifecycle`
133
-
-`owner`
134
-
- normalized `tags`
135
-
136
-
- corrected content quality issues such as:
137
-
- duplicate rule IDs
138
-
- conflicting `status` and `lifecycle` values
139
-
- inconsistent ATT&CK mappings
140
-
- unrealistic false positive sections
141
-
- legacy or package-style YAML structures that did not match the repository standard
142
-
143
-
- improved detection quality by:
144
-
- tightening noisy logic
145
-
- improving KQL consistency
146
-
- adding richer process, registry, file, and network context
147
-
- refining multi-source correlation logic
148
-
- separating broad foundational detections from narrower higher-fidelity companion analytics
149
-
- retiring or replacing weaker legacy duplicates where stronger rules already existed
150
-
151
-
### Areas reviewed
152
-
153
-
The cleanup covered content across:
154
-
155
-
-`browser`
156
-
-`collection`
157
-
-`command-and-control`
158
-
-`credential-access`
159
-
-`defense-evasion`
160
-
-`discovery`
161
-
-`execution`
162
-
-`exfiltration`
163
-
-`impact`
164
-
-`initial-access`
165
-
-`lateral-movement`
166
-
-`persistence`
167
-
-`privilege-escalation`
168
-
-`reconnaissance`
169
-
-`resource-development`
170
-
171
-
### Key outcomes
172
-
173
-
- cleaner rule placement by tactic folder
174
-
- fewer duplicate and near-duplicate analytics
175
-
- more consistent metadata and schema structure
176
-
- improved ATT&CK alignment
177
-
- better analyst-facing triage guidance
178
-
- clearer distinction between:
179
-
- foundational broad detections
180
-
- higher-fidelity specialized detections
181
-
- deprecated or legacy content
196
+
## Detection Lifecycle
182
197
183
-
### Triage guide improvements
198
+
Detection content should move through a controlled lifecycle:
184
199
185
-
Related triage guides were also reviewed and rewritten into a more complete analyst-playbook format. Updated guides now better align with detection logic and include clearer investigation flow, escalation criteria, and response guidance.
200
+
-`experimental`
201
+
-`testing`
202
+
-`production`
203
+
-`deprecated`
186
204
187
-
### Current direction
205
+
Lifecycle progression should reflect validation quality, operational usefulness, tuning maturity, and analyst confidence.
188
206
189
-
The repository is continuing to mature toward a more governed detection engineering model with:
207
+
See:
190
208
191
-
- stronger detection-as-code standards
192
-
- better lifecycle management
193
-
- improved quality control and validation
194
-
- more consistent triage support
195
-
- cleaner promotion from `experimental` to `testing` to `production`
0 commit comments