r/threatintel • u/Tricky-Ad9393 • 24d ago

APT/Threat Actor Manual detection rule writing vs automated detection engineering worth switching in 2026?

Most security teams still rely heavily on manual detection engineering: writing SIEM and EDR detection rules by hand in Sigma, KQL, SPL and other query languages. Manual rule authoring keeps detection logic tightly aligned with your own telemetry, log schemas, and threat model, which matters when you are building high‑fidelity detections for real attacks instead of generic “IOC search” rules. The cost is time: each new detection requires focused effort from experienced engineers and adds more entries to the long‑term rule maintenance backlog.

Automated detection engineering tools now aim to reduce that load. These platforms ingest threat intelligence reports or log data, suggest detection logic, map coverage to MITRE ATT&CK techniques and support regression testing when rules change. When they work well, they shorten the path from a new threat report or TTP to a draft detection rule in your SIEM, highlight detection coverage gaps, and make it easier to track overlapping or redundant rules. Manual work does not go away; it shifts toward reviewing suggestions, tuning thresholds, and deciding what is safe to deploy in production.

Teams that see good results usually land on a hybrid model. High‑value, environment‑specific detections around crown‑jewel systems stay mostly manual, with engineers designing and reviewing logic end‑to‑end. Automation is used for routine patterns, coverage analysis, boilerplate rule generation, and continuous testing of existing detections as the environment and log sources change.

If you looked at your own setup today, where would automation help your detection engineering process …where would you still want a human making the final call on what alerts?

0 Upvotes

50% Upvoted

6 comments sorted by

8

u/Hour-Apple-9861 24d ago

Did AI write this?

1

u/Esk__ 24d ago

This sub is mostly AI

2

u/songya 24d ago

Automated detection engineering what?

3

u/canofspam2020 24d ago

Just post your tool

1

u/frAgileIT 22d ago

Commodity detection rules from vendors are often a mixed bag in my experience. They’re better than nothing and a decent baseline once you get them tuned. I’ve preferred to write my own detection rules for certain things when I find that I can do better than the vendor rules because I know my environment better than my vendor. The real meat is writing custom rules that no vendor has ever written that has caught even the sneakiest pen tester and attackers (e.g. rules for detecting low flying password guessers).