A centralized repository for building, governing, validating, and reporting on a modern detection engineering program.
This repository serves as a one-stop location for:
- detection engineering strategy and program documentation
- executive proposal and maturity reporting
- detection-as-code content for Microsoft Sentinel
- governance, validation, tuning, and lifecycle standards
- ATT&CK and Cyber Kill Chain coverage tracking
- analyst triage guidance and operational support
- future multi-platform expansion, including Splunk
Detection engineering is more than writing alert logic. A mature program requires structure, governance, testing, reporting, and repeatable workflows that turn threat hypotheses into reliable, supportable analytics.
This repository is designed to support that full lifecycle.
Use these documents for program intent, operating model, roadmap, and reporting:
- Executive Documents
- Program Charter
- Roadmap
- Mission
- Scope
- Maturity Model
- Metrics Catalog
- Quarterly Program Review Template
- Annual Roadmap Review
- Gap Analysis
Use these resources to build, review, validate, and maintain detection content:
- Detections
- Governance
- Documentation Hub
- Detection Lifecycle
- QA and Validation Standard
- Tuning Standard
- Detection Rule Template
- Validation Checklist
Use these resources for investigation, escalation, and operational alignment:
- Triage Guides
- SOC and Incident Response Alignment
- Alert Escalation Guidance
- Detection Feedback Loop
- Coverage
docs/— executive artifacts, strategy, process, visuals, and reportingdetections/— detection content managed as codecontent/— templates, triage guides, and reusable operational contentgovernance/— naming, severity, lifecycle, tagging, and quality standardscoverage/— ATT&CK and Cyber Kill Chain coverage trackingautomation/— scripts, schemas, and deployment helperstests/— validation support and testing references.github/— workflows, templates, and contribution support
Core program artifacts are located in docs/executive/:
This repository is currently centered on Microsoft Sentinel detection engineering and is structured to mature into a broader, multi-platform detection engineering program over time.
Planned future growth includes:
- expanded automation and validation workflows
- stronger deployment and reporting pipelines
- additional platform support such as Splunk
- shared governance and reporting across security platforms
Detection content should move through a controlled lifecycle:
experimentaltestingproductiondeprecated
See:
All content should be version controlled, reviewed, and validated before promotion.
Recommended flow:
- Submit a request or change
- Review metadata, mapping, and quality
- Validate logic and operational usefulness
- Document tuning or triage considerations
- Merge through pull request review
- Promote through lifecycle stages
See:
This repository is licensed under the MIT License. See LICENSE.