Detection Engineering at MITRE ATT&CKCON 2023

In the talk “Detection as Code, Automation, and Testing: The Key to Unlocking the Power of Detection Engineering” Olaf Hartong provided some insights about the Detection Engineering approach at FalconForce. Automation is key, while maintaining an agile approach. Detections live as YAML in version control, every change gets a peer review, and pipelines lint, test and deploy them to multiple environments. Scheduled real attacks then confirm that each use case still raises an alert, because “it worked on my tenant” is not a test strategy. The NorthSec 2023 version of the talk names the stack behind it: Azure DevOps, Microsoft Sentinel, the Microsoft Defender suite, Azure Logic Apps and Functions. The offline KQL syntax and schema checks come from KQLAnalyzer, which FalconForce shares for free and which analyzes queries against the Sentinel and Microsoft 365 Defender schemas.