CyberSecurity Deep Dive
by Sergey Okinchuk
Building Human DefensesLogging That Actually Helps

Chapter Ten · Priya Fights Back

Detection and Monitoring

The intruder's campaign has run through Meridian's controls, and some of it got through. This is where Priya's SOC catches it — turning logs into detections, writing the rules that fire on the intruder's techniques, and hunting for what the rules missed. Detection is what turns "assume breach" from a slogan into an outcome.

5 topics

Prevention fails eventually — that is the assumption the whole book is built on — so the measure of a security program is how fast it detects the failure and how fast it responds. This chapter is the detection half: collecting the right data, correlating it into meaningful alerts, writing detections against the intruder's techniques, hunting for what automated rules missed, and measuring the whole thing by the numbers that matter.

Five topics: logging that actually helps, SIEM and correlation, detection engineering with Sigma, threat hunting, and measuring detection with MTTD and MTTR. The recurring theme is that the value of a detection system is not how many alerts it generates but how many a human can act on — and how quickly the attacker is caught.

From raw events to a caught intrusion
1
Log
the right events, off-host
2
Correlate
SIEM · alerts
3
Detect
Sigma rules · ATT&CK
4
Hunt and measure
threat hunting · MTTD/MTTR

Topics in This Chapter

Topic 52
Logging That Actually Helps
Detection is impossible without the right data. Log the security events that matter, centralize them off-host where an attacker can't erase them, and retain them long enough for a breach found months late.
Logging
Topic 53
SIEM and Correlation
A SIEM centralizes logs and correlates them, so events meaningless alone become a detectable attack pattern together. The SOC console — and the tuning problem that decides whether it helps or just makes noise.
SIEM
Topic 54
Detection Engineering
Detections don't write themselves. Turn an attacker technique into a rule that fires on it with few enough false positives to trust — Sigma for logs, YARA for files, treated as tested, version-controlled code.
Detection Eng
Topic 55
Threat Hunting
Detections catch what you thought to look for; hunting is the proactive search for what got through. Hypothesis-driven, ATT&CK-guided, and a feedback loop that turns every hunt into new detections.
Threat Hunting
Topic 56
Measuring Detection: MTTD and MTTR
A program that can't measure itself can't improve. MTTD and MTTR — how fast you detect and respond — are the numbers that matter, because attacker damage scales with time undetected. Beware vanity metrics.
MTTD / MTTR