Detection Engineering & Response

About Detection Engineering & Response

Detection engineering tools collect, correlate, and alert on security events from servers, endpoints, and network traffic. The category spans several tool types. SIEM platforms aggregate logs from across an organization and apply correlation rules to surface suspicious activity. EDR agents monitor endpoint processes, file operations, and network connections to detect malware and lateral movement. SOAR platforms automate alert triage and response actions, reducing the time analysts spend on repetitive investigation steps. Network detection engines like Snort and Suricata inspect traffic against signature and protocol anomaly rules, while Zeek provides session-level logging for forensic reconstruction. Detection rule frameworks like Sigma let teams write vendor-neutral rules and convert them to platform-specific query languages. The category also includes YARA, a pattern-matching tool used to identify and classify malware samples by file content. Teams building detection engineering programs use these tools together: SIEM for log aggregation and correlation, EDR for endpoint visibility, SOAR for response automation, and Sigma for portable rule management.