DETECTION ENGINEERING
Detection-as-Code: SIEM Correlation Pipeline
Overview
What this project is.
Elastic SIEM deployment with structured log ingestion from CloudTrail, VPC Flow Logs, and application telemetry. 15+ custom KQL correlation rules version-controlled as YAML in Git, each mapped to specific MITRE ATT&CK techniques with documented detection rationale and tuning methodology.
Problem
Why this matters.
SOC teams drown in noisy alerts. Detection rules need to be version-controlled, tested, and mapped to frameworks like MITRE ATT&CK.
Architecture
How it's built.
- Elastic SIEM for structured log ingestion and correlation
- Sources: CloudTrail, VPC Flow Logs, application telemetry
- 15+ custom KQL correlation rules mapped to MITRE ATT&CK techniques
- Detection rules version-controlled as YAML in Git
- Documented detection rationale and tuning methodology per rule
- Automated alerting via webhook integration
Tools
Tech stack.
Elastic SIEMCloudTrailKQLMITRE ATT&CKPythonSigma
Impact
Results.
Structured detection logic reduced false positive rate and enabled reproducible rule deployment
Presentation
How to showcase this.
Show log pipeline architecture. Include sample detection rule with MITRE mapping. Add dashboard screenshot.