Practical Threat Detection Engineering

11

Performance Management

In previous chapters, we have explored the detection engineering life cycle, from creating a test lab and building your first detection to testing and validating your detections. In this chapter, we will discuss a seemingly simple yet difficult-to-answer question: how good are we doing? We will look at this from multiple perspectives: the maturity of the detection engineering program and its associated productivity or efficiency, how well we historically detected the adversary, and how well we can expect to detect the adversary in the future.

We will cover the following main topics in this chapter:

• Introduction to performance management
• Assessing the maturity of your detection program
• Measuring the effectiveness of ...