Detection Engineering Field Manual | Zack Allen

Alerting and Detection Strategies (ADS) Framework | Palantir

A framework for developing alerting and detection strategies for incident response.

Synthetic Adversarial Log Objects (SALO) | Splunk

Synthetic Adversarial Log Objects: A Framework for synthentic log generation

Open Threat Informed Detection Engineering aka OpenTide'

an all-in-one Detection Engineering Operations framework created and maintained by the European Commission to convert your CTI into an actionable detection coverage graph combining threat vectors with detection objectives, and manage your entire detection library from a central repository with a detection-as-code deployment system. The OpenTide format aims at measuring and expanding detection coverage, and its rule deployment engine is fully extensible and support multiple platforms in parallel (leveraging all the technology features and native query language). OpenTide works both within a single DE team as a main framework, and across SOC as a common format to facilitate data interexchange

Prioritizing Detection Engineering | Ryan McGeehan

A longtime detection engineer outlines how a detection engineering program should be built from the ground up