https://detectionops.com Detection engineering as code - rules in Git, tested in CI, validated against real adversary behaviour. Field notes, an open rule library, a delivery platform and hands-on consulting. en https://detectionops.com/blog/detection-as-code-pipeline https://detectionops.com/blog/detection-as-code-pipeline Most detection-as-code talks stop at 'put your rules in Git'. Here is the rest of it - the lint stage, the unit tests, the deploy gate, and the part nobody mentions: what happens when a rule starts failing in production. Sat, 05 Sep 2026 00:00:00 GMT detection-as-code ci-cd process https://detectionops.com/blog/attack-coverage-is-lying-to-you https://detectionops.com/blog/attack-coverage-is-lying-to-you A green heat map with 78% coverage is the most comfortable lie in security. Here is why technique counting breaks down, and what to measure instead. Fri, 21 Aug 2026 00:00:00 GMT mitre-attack metrics strategy https://detectionops.com/blog/kerberoasting-from-ttp-to-rule https://detectionops.com/blog/kerberoasting-from-ttp-to-rule A full walkthrough - the protocol behaviour, the naive rule everyone writes first, why it drowns you, and the tuned version with its test cases. Wed, 19 Aug 2026 00:00:00 GMT windows active-directory walkthrough https://detectionops.com/blog/sysmon-tuning-signal-without-the-flood https://detectionops.com/blog/sysmon-tuning-signal-without-the-flood Sysmon out of the box will bury you. A per-event-ID walkthrough of what to keep, what to drop, and how to work out the licence cost before you deploy to 10,000 endpoints. Thu, 30 Jul 2026 00:00:00 GMT windows telemetry sysmon