Prioritization of the Detection Engineering Backlog

Written by Joshua Prager and Emily Leidy

Introduction

Strategically maturing a detection engineering function requires us to divide the overall function into smaller discrete problems. One such seemingly innocuous area of detection engineering is the technique backlog (a.k.a. the detection engineering backlog, attack technique backlog, or detection backlog).

The concept of incorporating a backlog into the detection engineering function as a medium for receiving and storing attack techniques for detection generation is not a novel concept for most organizations. However, …

cybersecurity detection detection engineering engineering threat hunting threat intelligence