Detection engineering at scale: one step closer (part one)

This article introduces challenges faced by Security Operations and Detection Engineering teams when creating, maintaining, and scaling detection rules across heterogeneous enterprise environments. It highlights two main factors — increasing attacker sophistication and expanding, non-standardized log sources — and provides a phishing AiTM use case with Sigma rule examples to illustrate how normalisation (e.g., using ECS fields) can improve vendor-agnostic detections. The piece frames detection engineering problems and previews further articles on methods, CI/CD automation, and ongoing monitoring.