This chapter describes how the blue team's work of engineering, running and tuning detections changes when each detection becomes a versioned record and AI drafts candidates for review. It concerns B2 Detect, and it hands its output to B3 Investigate, because every alert a detection raises is the first claim that Chapter 7 will test. The chapter covers the detection record, the pipeline that carries it into production, AI as drafter, the testing that decides whether a detection counts, the measurement of coverage and cost, the detections that suppliers hold, and detection debt. Its central discipline is short: a detection is not accepted until a test shows that it fires and a measure shows what it costs in false positives.
A rule that lives only inside a security information and event management (SIEM) console is a configuration without a history. Nobody can say who wrote it, which threat it was meant to catch, which log source it depends on, when it last fired for a real reason or whether the log source is still arriving. Most security operations centres (SOCs) start there, and so does Nordvik Region: AI Red Team, Chapter 19, treated detections, intelligence and deception as code for a large estate, and this chapter takes the next step for a team, which is to decide what a detection is.
A detection record (DET-NR-NNNN, DET-HM-NNNN) is the versioned definition of one detection. It holds six things that a rule alone does not:
Primary topics explored
- From rules to records
- Detection pipelines
- AI as drafter
- Testing
- Coverage and cost
- Vendor-supplied detections
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 6: Detect: Detection Engineering as Code in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Craft” and is one of 32 drawn from the manuscript.