Do you know your Detection Surface?

This article advocates building a comprehensive, living documentation of SIEM data sources to understand and improve an organization’s detection surface. It recommends cataloging ingestion methods, log categories, and volumes; conducting PEAK baseline hunts to learn new datasets; and using DeTT&CT with MITRE ATT&CK and EDR Telemetry to measure coverage and quality. The goal is to operationalize detection engineering so teams can confidently answer whether they can detect specific techniques.