Skip to main content
Tag

Detection engineering

4 articles on detection engineering.

← All blog posts
YARA vs Sigma: Which Detection Rule Should You Use?
Malware2026-08-24

YARA vs Sigma: Which Detection Rule Should You Use?

Compare YARA and Sigma by data source, purpose, portability, performance, false positives, testing, and threat-intelligence workflow.

4 min read
HTML Smuggling: Detection and Incident Response
Malware2026-08-24

HTML Smuggling: Detection and Incident Response

Detect HTML smuggling by correlating browser file creation, JavaScript Blob behavior, download telemetry, endpoint execution, and threat intelligence.

3 min read
Agentic AI Threat Mapping: MITRE ATT&CK Needs Evidence-Rich Workflows
AI & ML2026-07-08

Agentic AI Threat Mapping: MITRE ATT&CK Needs Evidence-Rich Workflows

Anthropic mapped AI-enabled cyber activity to MITRE ATT&CK and found gaps around autonomous orchestration. SOC teams need AI summaries tied to evidence, not unsupported verdicts.

4 min read
Hash Reputation at Scale: Building Detection Rules That Survive Real Networks
Malware2026-04-22

Hash Reputation at Scale: Building Detection Rules That Survive Real Networks

Move beyond one-off hash blocks: design reputation pipelines, reduce false positives, and integrate file intelligence with IP and domain context for production-ready detection engineering.

8 min read