Detection Engineering
Poor Detection Rule Quality
Rules written once and never maintained become stale, noisy, or blind to evolved attacker techniques.
What it is
Detection rules degrade over time as environments change and attacker techniques evolve. A rule written for a specific process path breaks when the path changes. A rule calibrated for a previous log schema stops matching after an upgrade. Rules based on static IOCs (IP addresses, file hashes) become useless as attackers rotate infrastructure. High-quality detection requires rules based on attacker behaviour and technique — not artifact-based indicators that expire.
Attack techniques
- IOC-based rules with expired indicators
- Rules broken by environment changes
- No rule testing or validation process
- Missing coverage for new attacker TTPs
- Sigma rule adoption without environment tuning
Business impact
A rule that does not fire is worse than no rule — it creates false confidence that a detection exists where none actually does. Detection rule quality requires active maintenance, not set-and-forget deployment.