DETECTION ENGINEERING COVERAGE MEASUREMENT AND PRIORITIZATION

Ensuring detections are up to date and effective while optimizing resources is a challenge for detection engineers. Understanding existing coverage, researching threats, and figuring out which detections to prioritize and build is a time-consuming puzzle to piece together. It is also difficult to know how to optimize resources to make sure the organization is covered. 

Tidal Cyber addresses the challenge by mapping coverage to prioritize detections, cataloging detections for visibility into what has been built as well as what is in the pipeline, and tracking how vendors are providing detections. We also track changes in detection coverage to maintain an up-to-date inventory. 

 Detection engineers quickly understand their existing coverage and gaps, where to focus their time and talent on writing detections, and when they can turn to vendors to minimize duplicate efforts. Documentation of detection engineering improvements makes it easy to demonstrate the results of their efforts and track the detection’s lifecycle from idea to implementation.