By Role: Detection Engineer
Build detections that get better over time
You wrote 200 detection rules last year. You know they fire — you see the alert volume. You don't know which ones are high-signal and which ones are noise generators. ManySignal closes that feedback loop.
The detection engineering feedback gap
Detection engineers write rules, deploy them, and move on to the next coverage gap. The feedback on rule quality — whether the rule produces high-signal alerts or noise — rarely makes it back to the engineer who wrote it. Analyst frustration with noisy rules stays in the SOC queue. Coverage gaps persist because there's no systematic measurement of what's missing.
ManySignal closes this loop. Every rule's performance is tracked continuously and surfaced to the detection engineering team. Coverage gaps are ranked by threat actor prevalence. Back-testing validates changes before they reach production. The result is a detection estate that improves over time rather than drifting toward noise.
ATT&CK-mapped, tunable, Sigma-compatible
Historical validation before production deployment
Average after first 90-day tuning cycle
Day in the life: before and after ManySignal
- Write a rule, deploy it, never hear about it again unless analysts complain
- Coverage gaps discovered after incidents, not proactively
- Rule testing requires building a lab environment manually
- No systematic measurement of which rules produce high-quality alerts
- ATT&CK mapping is manual effort and frequently out of date
- Weekly rule performance report — FP rate, TP rate, analyst MTTR per rule
- ATT&CK heatmap shows coverage gaps ranked by industry threat prevalence
- Back-test in production environment against 90 days of real data
- Tuning suggestions surfaced automatically for high-noise rules
- Sigma rule import with auto-mapping to data sources
"ManySignal showed me that three of the rules I was most proud of were generating 40% of our total alert noise. The tuning suggestions fixed two of them in an afternoon. Now I actually know what my detection estate looks like."
Detection engineer FAQ
How does ManySignal help detection engineers measure the impact of their work?
ManySignal provides per-rule analytics: alert volume, false positive rate, true positive rate, analyst MTTR for alerts from that rule, and suppression rate. Detection engineers can see exactly which rules they've written are high-performing and which need tuning. This measurement closes the feedback loop that's missing in most detection programs — engineers know their rules fire, but rarely know whether they fire well.
Does ManySignal provide a rule testing environment?
Yes. ManySignal's rule sandbox allows detection engineers to test new rules against historical alert data before deploying to production. The back-test report shows how the rule would have performed over the past 90 days: alerts generated, estimated false positive rate based on historical context, and whether it would have caught known true positive events in the same period.
How does ManySignal approach detection-as-code?
ManySignal supports rule management via Git-based workflows. Detection rules can be stored in version control, reviewed via pull request, tested via CI pipeline integration, and deployed through a GitOps workflow. Rule changes trigger automatic back-testing in CI, and the test report is posted to the pull request before merge. This brings software engineering practices to detection engineering.
Can ManySignal ingest detection rules from external sources like Sigma?
Yes. ManySignal supports Sigma rule import and can translate Sigma rules into its native detection format with mapping to the configured data sources. Rules imported from threat intelligence providers, open source repositories (Elastic Detection Rules, Splunk Security Content), and ISAC sharing are automatically back-tested against your environment before activation.
How does the entity graph enhance detection rule quality?
Rules can reference entity graph properties directly — blast radius, days since last login, privilege tier, observed geo — as filter or scoring conditions. This eliminates a major source of false positives: context that a rule couldn't know at alert time but that determines whether the alert is meaningful. Entity-graph-aware rules are typically 3–5x more precise than event-field-only rules.
What is the promotion workflow for moving a rule from alert-only to active?
Detection engineers configure a precision target (e.g., 90% of alerts in the last 14 days must be confirmed true positives). ManySignal tracks precision continuously in alert-only mode and notifies the engineer when the threshold is met. The engineer reviews the precision data and promotes the rule via the platform or CI pipeline.
How does ManySignal help prioritise which coverage gaps to fill?
The coverage gap analysis overlays your specific threat model — industry, data sources, historical incident types — against the ATT&CK coverage map. Gaps are ranked by exploitation frequency in real-world incidents. Detection engineers can request gap-filling from the ManySignal detection library or build custom rules targeting the highest-priority gaps first.
Can detection engineers write rules that leverage machine learning model outputs?
Yes. Behavioural baseline deviation scores and clustering outputs are available as rule conditions. A rule can fire when entity.baseline.deviation_score > 80 and entity.api_call_volume.percentile_rank > 95 — combining ML-derived features with deterministic event conditions in a single detection.
What is the response if a detection rule causes a significant false positive spike?
Rules with a sudden precision drop (>30% false positive rate spike in a 24-hour window) are automatically throttled — escalation is paused while the rule continues in alert-only mode. The detection engineer receives a notification with the precision metrics and can diagnose and patch the rule before re-enabling escalation.
Build detections with a feedback loop, not just a deploy button
Rule performance analytics, back-testing, and ATT&CK coverage heatmaps — built for detection engineering excellence.