Detection engineering at scale: one step closer (part one)

This article examines the challenges of scaling detection engineering as attacker TTPs proliferate and enterprise environments become more hybrid and diverse, creating normalization and rule-maintenance burdens that drive false positives and alert fatigue. It advocates CI/CD-driven processes, continuous monitoring, and vendor-agnostic detection design, illustrating with an AiTM phishing use case and a Sigma/ECS pattern that emphasizes normalization to reduce rule duplication across Microsoft 365 and Entra ID. The piece sets the stage for subsequent posts detailing Sekoia.io’s methodology to streamline and scale detection engineering.