Embed Security lets analysts teach its AI SOC how to investigate
Customer iSteps, NoiseIQ Memories and Detection Engineering encode local practice and suggest SIEM detection changes.
Stories per day · 30 days
2 RSS
Relatedsiem5soc4sigma2splunk2ai-agents1atomic-red-team1attck1block1buyers-guide1cisco1daybreak1embed-security1interview1least-privilege1mcp1openai1open-source1panther1
31 stories, newest first · one card per story
Stories tagged #detection-engineering
Panther leads editorial ranking of 2026 detection engineering tools
Research-based scores, not lab tests, place Anvilogic second and SOC Prime third, with Sigma as the portability baseline.
1
Eleven detection engineering tools evaluated for 2026
Buyer’s guide judges Panther, Anvilogic and others on as-code rigor, ATT&CK coverage and backend portability.
1
Cisco open-sources Quarry to detect multi-step AI agent attacks
The neurosymbolic rule language is meant to flag intent that appears only across benign agent steps.
Talos interview covers Ryan Fetterman's path into detection research
He recounts 15 years from federal SOC work and Splunk's SURGe team into Talos, including an early Pandora Song case.
1
Corelight field CTO urges human review before SOC agents act
Vince Stoffer says teams should watch shadow AI, least privilege, change audits, and network use of AI.
ARMS mutates detection rules for related attack technique variants
Authors say nearly all generated Sigma variants compiled to SIEM queries and about 92% still caught the original behavior.
How Block is building AI-powered security with OpenAI technology
Block reports using OpenAI Daybreak to speed alert triage, investigations, and vulnerability patching.
When building an AI-native security program, start with outcomes
Opinion: lean teams should apply AI first to security outcomes they cannot deliver consistently.
1
From Telemetry to Defense: How SOC and MSSP Leaders Can Build Intelligence-Led Threat Monitoring
ANY.RUN promotes intelligence-led SOC monitoring using sandbox feeds, behavioral lookup, and YARA rule testing.
2
How AI Is Changing the Roles Required in the Security Operations Center
Rapid7 says AI should move SOC analysts from alert triage to case ownership, citing Gartner workforce guidance.
The Fine Art of Frustrating the Adversary
Cisco Talos researchers share defender techniques—deception, honeypots, behavioral detections, and AI agent boundaries—to slow and expose adversaries.
4
Threat detection dashboards are masking security coverage gaps
Conifers found 47% of deployed detections need fixes and about one-third of known threats lack coverage.
2
The SOC Doesn't Need to Start Over with Every Alert
Opinion piece argues AI cheapens retrying failed intrusions and urges SOCs to fix lossy handoffs between intel, hunting, detection, investigation, and remediation.
1
How It's Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules
SuriCap study of 60 engineers writing 3,146 Suricata rules finds prior experience barely affects rule quality and identifies three rule-engineering phases.
Cloud Threat Emulation on Autopilot: Context is Everything
Elastic outlines a plan-first cloud threat-emulation lifecycle so detections rest on realistic identity, telemetry, and cleanup.
Building an AI Detection Engine That Understands Agent Intent
Wiz details an AI detection engine using model input/output telemetry to catch agent intent hijacking, citing the OpenAI Hugging Face breach.
5
UltraViolet Cyber Equinox measures detection coverage against MITRE frameworks
UltraViolet Cyber launches Equinox, an AI-automated platform mapping SIEM and EDR detection coverage against MITRE ATT&CK and ATLAS frameworks.
4
Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware
Attackers abuse Windows VSS shadow copies to delete recovery points before ransomware and to extract NTDS.dit/SAM credentials, demanding context-aware detection.
5
Linux Detection Engineering - Local Privilege Escalation
Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.
9
The longitude problem: In the AI era, detection is won on facts, not guesses
Opinion piece argues defenders should beat AI-era attackers by carrying verified ground truth about approvers, domains, and vendors instead of relying on inference.
What breach and attack simulation needs to become in the AI era
Picus argues calendar-driven BAS is obsolete as AI compresses exploit timelines, citing 338 million simulations showing 69% prevention and a flat 14% alert score.
6
Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes
Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.
4
Mars Security brings threat intelligence to detection in real time
Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.
3