How data science can boost your detection engineering maintenance and keep you from herding sheep

This blog post outlines a practical, data-driven approach to detection engineering maintenance, advocating Detection-as-Code and cross-environment correlation to collect and analyze three data categories (detection data, environment-specific metadata, and post-deployment alert time-series). It defines maintenance metadata (e.g., review dates, TP flags, trigger ratios, threshold changes), shows how to use time-series trends to find broken/noisy detections, guides systematic tuning (allowlisting hygiene, threshold and severity alignment), and sets criteria for deprecation and prioritization of high-value rules. The authors caution against overreliance on inconsistent SOC classifications, recommending iterative experiments with consistent data structures and long-term alert telemetry to drive reliable decisions.