Skip to content

docs: clarify supporting detection engineering role #58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
egrexsec wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: clarify supporting detection engineering role #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# DetLab-DAC

Documentation-first detection engineering platform for writing, comparing, and publishing a single detection across multiple rule and query languages.
Active supporting detection-engineering workbench for turning investigation findings and telemetry gaps into reviewable detections across multiple rule and query languages.

![DetLab homepage](docs/assets/screenshots/detlab-home.png)

## Project summary

DetLab-DAC packages detection engineering as a **documentation-first workflow**. Instead of starting with one platform query and losing the rest of the context, the project centers a canonical detection brief and maps it to multiple implementations.
DetLab-DAC packages detection engineering as a **documentation-first workflow**. It supports investigation and lab work by converting observed behaviors, investigation findings, and telemetry gaps into canonical detection briefs that can be reviewed and mapped to multiple implementations.

The repo currently combines:
- detection content in-repo
Expand Down Expand Up @@ -47,6 +47,7 @@ DetLab-DAC keeps those pieces together in one detection brief.
## What this is

- a documentation-first detection engineering repository
- an active supporting workbench that converts investigation findings and telemetry gaps into reviewable detection content
- a canonical-detection authoring workflow
- a multi-language comparison surface for the same detection idea
- a place to store telemetry assumptions, ATT&CK mapping, triage guidance, and validation notes alongside the rule logic
Expand All @@ -55,13 +56,14 @@ DetLab-DAC keeps those pieces together in one detection brief.

- not a SIEM product
- not a generic threat-hunting platform
- not an IR case management system
- not a DFIR case-management or evidence-tracking system
- not a forensic acquisition, evidence-preservation, or evidence-retention platform
- not a lab automation suite
- not a guarantee that every detection is production-validated in every environment

## Current status

**Active early-stage project.**
**Active early-stage supporting detection-engineering workbench.** It complements investigation workflows; it does not replace DFIR case, acquisition, or evidence systems.

What is confirmed in the repository today:
- a Next.js web frontend under `web/`
Expand Down Expand Up @@ -119,8 +121,8 @@ web/ Next.js frontend and workbench

## Tech stack

- Next.js 14
- React 18
- Next.js 16
- React 19
- TypeScript
- Node built-in test runner (`node --test`)
- Markdown/YAML-based detection artifacts
Expand Down
2 changes: 2 additions & 0 deletions ROADMAP.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# Roadmap

DetLab-DAC remains an active supporting detection-engineering workbench: its roadmap focuses on converting investigation findings and telemetry gaps into reviewable detections, not on building DFIR case management, forensic acquisition, or evidence storage capabilities.

## Near term

- keep the detection lane narrow and well-documented
Expand Down
Loading