Detection
Identifying that an incident or anomaly has occurred.
Detection is the second step of the incident response process and the hinge of the whole response — you can’t act on what you never see, and dwell time (how long an attacker goes unnoticed) is often measured in weeks. Mean time to detect (MTTD) is a core SOC metric; detection engineering builds repeatable, testable analytics tied to threat models rather than relying on ad-hoc rules.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →