Detection Engineering Handoff and Coverage Assessment
What this domain tests
This domain tests the transition from hunt finding to maintainable detection, and the ability to assess coverage without inflating it. Expect questions on handoff artifacts, testing, ownership, and ATT&CK coverage quality.
Core rules
- A handoff package includes detection logic, ATT&CK mapping, required data sources and fields, severity, false-positive profile, test cases, response guidance, owner, and version.
- Treat detections as code: peer review, version control, backtesting, and regression tests. Include at least one benign and one malicious test case.
- Coverage is not a technique count. Assess whether the data is collected, parsed, retained, and queried with an analytic that matches adversary procedure. Separate logged, detected, and responded coverage.
- Prioritize coverage against the threat model and known procedures. A technique with no relevant adversary use may be lower priority than a partially covered technique used by a targeted group.
- Reassess after telemetry changes, platform changes, and ATT&CK updates. Stale mappings are coverage debt.
Worked example
A hunt validates T1053.005 scheduled-task creation. The handoff specifies Security 4698, Sysmon event 1, and Task Scheduler 106; filters for standard update tasks; severity and response steps; and benign and malicious test cases. Coverage is marked partial if 4698 is enabled but process command lines are unavailable, because the detection cannot distinguish creator context. Reasoning: coverage reflects analytic capability, not the presence of one event ID.
Traps that cost marks
Equating ATT&CK technique count with coverage, handing off a query without data requirements, omitting test cases and ownership, and leaving mappings stale after telemetry changes.