suKTech24

How to create Threat Detection Use Case 101

Weekly #9-2025 – By suktech24, Fri 27 June 2025, Estimated reading time : 8 mins

When I first started as a threat detection analyst, I found creating detection use cases quite challenging – I wasn’t sure where to begin. Over time, through trial and error, learning from colleagues, reading blog posts, listening to podcasts like Detection Dispatch , and learning from the generous knowledge sharing from the security community in SubStack and Medium, I picked up a number of useful tips. In this article, I’ll share a practical checklist. It’s designed to help junior detection engineers and analysts build high-quality detection use cases, based on lessons I’ve learned and the resources listed in the references.

Threat Detection Use Case Development Checklist

  1. Understand the technology and environment
  2. Under what is normal and what is abnormal
  3. Research Existing Use Cases and leverage them
  4. Collect and Validate logs
  5. Draft Detection Logic in a Reusable Format ( Sigma or Yara)
  6. Validate in Dev/Test Environment
  7. Peer Review and Stakeholder Feedback
  8. Deploy to Production
  9. Maintain and Improve Continuously

Threat Detection Use Case Development Checklist

  1. Understand the technology and environment
  2. Under what is normal and what is abnormal
    • *** Start by understanding what normal looks like, then look for deviations. ***
    • Based on your research in Step-1, you will have a good understanding of expected normal flow. Map them out.
    • Create a simple flow diagram (It does not have to be a fancy one. Just text and arrow are fine).
    • Define what behavior would be considered malicious or abnormal. And mark those points on the flow diagram. These will be your detection opportunities.
    • Use either MITRE ATT&CK tactics/techniques or Cyber Kill Chain and map threat scenarios and attack surfaces. I use MITRE ATT&CK tactics/techniques. They are useful for aligning detections with adversary techniques.
    • If you uncover more than one potential use cases, map attack surface, entry points, etc. for each use case.
  3. Research Existing Use Cases and leverage them
  4. Collect and Validate logs
    • *** Use case quality depends on logging quality ***
    • Ensure logs from relevant resources ( e.g. e.g. Windows Security Event logs, Sysmon, Linux syslog/audit) via agents) are ingested.
    • At parsing phase, make sure all the relevant fields needed for the detection use cases are correctly parsed/extracted.
  5. Draft Detection Logic in a Reusable Format ( Sigma or Yara)
  6. Validate in Dev/Test Environment
    • *** Your first version is rarely the best. Test and tune repeatedly ***
    • Run the detection in a non-production environment for 2 – 5 days. Short duration will not be sufficient to monitor the behavior.
    • Ingest test logs to trigger the detection and confirm the logic works as intended.
    • Simulate attack scenarios where possible to validate the detection coverage.
    • Track detection outcomes
      • How many alerts fire?
      • Are they True/False positives?
      • Tune the logic ( Add conditions, whitelist, blacklist, add thresholds, how the
  7. Peer Review and Stakeholder Feedback
    • *** Feedback from the SOC or Product team is essential for contextual usefulness ***
    • Request peer review from fellow threat detection team
    • Get input from the SOC team, who will triage the alerts.
    • Use a QA checklist for detection use case to standardise reviews.
    • If you are reviwer, check for
      • Detection logic correctness – Does it accurately capture the intended behavior?
      • Noise level – is the threshold acceptable, realistic and actionable?
      • Response readiness – How can SOC respond to the detection? SOAR Playbook or manual?
    • Once feedback is received, update and re-run the detection if needed.
  8. Deploy to Production
    • *** Production rules need to be stable, documented, and monitored ***
    • Move the rule to production after successfully passing both Peer and SOC reviews
    • Configure alert routing – e.g. SPLUNK SOAR playbook, email, slack, etc.
    • Track the effectiveness of the detection and SOC analysts triage outcomes (true/false positives, actions taken) post deployment
    • If needed, tune the detection logic and provide as much context as possible in the ticket for future references.
  9. Maintain and Improve Continuously

References

  1. About Detection Engineering, Florian Roth, Sep 12 2022, https://cyb3rops.medium.com/about-detection-engineering-44d39e0755f0
  2. Awesome-detection-engineering, https://github.com/infosecB/awesome-detection-engineering
  3. Detection as Code: Key Components, Tools, and More, https://www.legitsecurity.com/aspm-knowledge-base/detection-as-code
  4. Detection as Code: How To Embed Threat Detection into Code, Muhammad Raza, July 11 2023, https://www.splunk.com/en_us/blog/learn/detection-as-code.html
  5. Detection Engineering, https://cymulate.com/cybersecurity-glossary/detection-engineering/
  6. Defender’s Toolkit 102: Sigma Rules, Syed Hasan, Mar 6, 2021, https://syedhasan010.medium.com/defenders-toolkit-102-sigma-rules-4a623acb2036
  7. Detection Dispatch, https://www.youtube.com/@Anvilogic
  8. Detection Development Lifecycle, Snowflake’s implementation of the Detection Development Lifecycle, Haider Dost, Jan 19 2022, https://medium.com/snowflake/detection-development-lifecycle-af166fffb3bc
  9. Detection Engineering Explained, https://www.splunk.com/en_us/blog/learn/detection-engineering.html
  10. Detection Engineering Maturity Matrix, Kyle Bailey, https://detectionengineering.io/
  11. Detection Engineering Maturity Matrix, Kyle Bailey, Apr 26, 2021, https://kyle-bailey.medium.com/detection-engineering-maturity-matrix-f4f3181a5cc7
  12. Elastic releases the Detection Engineering Behavior Maturity Model, Mika Ayenson PHD, Terrance DeJesus, Samir Bousseaden, https://www.elastic.co/security-labs/elastic-releases-debmm
  13. Getting Started with Detection-as-Code and Google SecOps (Part 1 of 2), https://www.googlecloudcommunity.com/gc/Community-Blog/Getting-Started-with-Detection-as-Code-and-Google-SecOps-Part-1/ba-p/702154
  14. How we use Datadog for detection as code, Oct 11 2024, https://www.datadoghq.com/blog/datadog-detection-as-code/
  15. How to Make Threat Detection Better?, Anton Chuvakin, Jul 31 2021, https://medium.com/anton-on-security/how-to-make-threat-detection-better-c38f1758b842
  16. How to start in creating detection Use Case, Reddit, https://www.reddit.com/r/cybersecurity/comments/jodq0t/how_to_start_in_creating_detection_use_case/
  17. My first use case, https://cloud.google.com/chronicle/docs/soar/respond/start-developing/my-first-use-case
  18. Rule Creation Guide, https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide
  19. SigmaHQ, Rule Create Guide, https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide
  20. The Ultimate Guide to Sigma Rules, Jeff Darrington, February 18, 2025, https://graylog.org/post/the-ultimate-guide-to-sigma-rules/
  21. What is your Approach for Building Cyber Threat Use Cases?, July 21 2020, https://www.correlatedsecurity.com/what-is-your-approach-for-building-cyber-threat-use-cases/
  22. What is Detection as Code? How to implement Detection-as-Code, Tahir, Apr 15 2025, https://medium.com/@tahirbalarabe2/what-is-detection-as-code-how-to-implement-detection-as-code-ae8e3bac22f7
  23. What Are SIGMA Rules: Beginner’s Guide, Adam Swan, May 16 2022, https://socprime.com/blog/sigma-rules-the-beginners-guide/
  24. What Is Detection Engineering?, Oleksandra Rumiantseva, July 14 2023, https://socprime.com/blog/what-is-detection-engineering/
  25. What Makes a “Good” Detection?, The Shannon Signal Score: A Framework for Measuring Detection Value, Dylan, Oct 11 2024, https://medium.com/@dylanhwilliams/what-makes-a-good-detection-dd6a3b373860
  26. What Makes a “Good” Detection, Ryan G. Cox, Dec 04, 2024, https://www.cyberseccafe.com/p/what-makes-a-good-detection

Leave a comment