---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
The purpose of this policy is to define the roles, responsibilities, and processes for detection engineering within a Security Operations Center (SOC) to ensure that detection mechanisms are aligned with organizational risk, adaptable to an evolving IT and cybersecurity landscape, and continuously evaluated for efficacy. This policy will guide the SOC in supporting and collaborating with internal and external detection engineering teams, as well as adjacent teams such as Cyber Threat Intelligence (CTI), Threat Hunt, Red Team, and Purple Team, to maintain and enhance the organization’s cybersecurity posture.
## Scope
This policy applies to all personnel involved in detection engineering efforts within the Security Operations Center (SOC), including but not limited to SOC analysts, threat hunters, CTI teams, Red and Purple teams, detection engineers, and cybersecurity leadership. It encompasses all detection rules, techniques, and procedures used within the SOC to detect cybersecurity threats and malicious activity, and applies to all systems, networks, and applications within the organization’s IT environment.
## Roles and Responsibilities

| Role                                 | Responsibility                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| ------------------------------------ |   |
| SOC Team                             | Monitor, evaluate, and respond to alerts generated by detection rules.Engage with other teams to assess and provide feedback on detection rule efficacy.Assist in maintaining a library of detection rules and ensure they are reviewed and updated periodically.Coordinate with Threat Hunt, Red Team, and Purple Team to understand new attack vectors and TTPs for rule creation.Provide feedback on the performance and tuning of detection rules, specifically evaluating the true positive to false positive ratio. |
| Detection Engineering Team           | Develop, implement, and maintain detection rules aligned with the organization’s risk profile.Continuously refine detection rules based on feedback from the SOC, Threat Hunt, and other teams.Ensure detection rules follow a structured Detection Lifecycle from creation through evaluation, adjustment, and decommissioning.Support the SOC in testing and validating detection rules through simulations and real-world scenarios.Provide metrics on detection rule performance and efficacy to leadership.          |
| Cyber Threat Intelligence (CTI) Team | Share intelligence on emerging threats, attack vectors, and TTPs to support the creation of new detection rules.Analyze and present threat trends to SOC and detection engineering teams to inform rule adjustments.Collaborate with other teams to ensure detection rules reflect the most current understanding of threat landscapes.                                                                                                                                                                                           |
| Threat Hunt Team                     | Conduct proactive hunting efforts to identify novel threats and attack techniques.Collaborate with SOC and detection engineering teams to validate detection rules and uncover new attack methods requiring new detections.Provide feedback to SOC and detection engineers based on the outcomes of hunts.                                                                                                                                                                                                                        |
| Red Team                             | Simulate real-world attack scenarios to test the efficacy of detection rules.Report findings to SOC and detection engineering teams regarding gaps or false negatives in detection capabilities.Work collaboratively to refine and improve the overall detection strategy.                                                                                                                                                                                                                                                        |
| Purple Team                          | Facilitate collaboration between Red and Blue Teams (SOC) to validate and test the real-world effectiveness of detection rules.Offer continuous feedback to SOC and detection engineers for improvements based on simulated attacks.                                                                                                                                                                                                                                                                                                  |
| Cybersecurity Leadership             | Coordinating Detection Lifecycle including regular review meetings.Reviewing metrics and outcomes associated with Detection Engineering.                                                                                                                                                                                                                                                                                                                                                                                              |

## Policy Statement
Detection engineering is a vital component of an effective Security Operations Center (SOC) and contributes directly to the organization’s ability to identify and respond to security threats. The SOC must collaborate with internal and external detection engineering teams to ensure the continuous development, tuning, and evaluation of detection rules aligned with organizational risk. This collaboration will also enable the SOC to adapt to emerging cybersecurity threats, vulnerabilities, and attack techniques. Detection rules must be iteratively improved to achieve a balance between detection efficacy and minimizing false positives.

A continuous feedback loop is required between the SOC and testing teams (such as Threat Hunt, Red Team, and Purple Team) to evaluate the performance of detection rules. Additionally, all teams within the SOC should present ideas for new detection rules based on observations, intelligence, and emerging trends.

The SOC should maintain a comprehensive library of detection rules and metrics that demonstrate the efficacy of each rule. This policy ensures that detection rules undergo a rigorous lifecycle, from creation through deployment, testing, adjustment, and eventual decommissioning.
### Policy Elements

1. **Detection Lifecycle Management**
    - Detection rules must follow a structured lifecycle, beginning with development, followed by deployment, testing, and periodic evaluation. Rules should be adjusted or decommissioned based on performance and evolving threats.
    - Regular reviews of existing detection rules must occur to ensure they remain relevant and effective against current and emerging threats.
    - The lifecycle of each detection rule will include clear documentation, version control, and performance metrics.
    - The Detection Engineering team must maintain an open backlog of prioritized detections for new development.
    - Regular (weekly) meetings should be conducted to review the state of detection engineering, evaluate tuning requests, prioritize new detections, and plan detection development.
2. **Continuous Evaluation of Detection Rules**
    - The SOC, along with Threat Hunt, Red Team, and Purple Team, must continuously evaluate the true positive and false positive rates of detection rules.
    - Periodic assessments will be conducted to ensure the accuracy and efficacy of detection mechanisms in identifying genuine threats without overwhelming analysts with false alarms.
    - Detection rules should evolve based on the changing IT and cybersecurity landscape.
3. **Feedback from Adjacent Teams**
    - Collaboration between SOC, CTI, Threat Hunt, Red Team, and Purple Team is essential to ensure that detection engineering remains aligned with current threat intelligence, attack vectors, and adversary TTPs.
    - All teams must provide feedback on existing detection rules, including suggestions for new rules based on the latest findings from threat simulations, hunts, and intelligence reports.
4. **Metrics and Reporting**
    - Detection engineering efforts must be supported by routine metrics and performance indicators that demonstrate the value of the program. These metrics should be evaluated regularly and presented to cybersecurity leadership to guide decision-making and ensure continual improvement.
    - Key metrics will include the effectiveness of detection rules, false positive rates, detection speed, and coverage of known attack techniques.
5. **Library of Detection Rules**
    - The SOC must maintain a centralized repository for all detection rules, with clearly defined naming conventions, documentation, and version history.
    - The library must be accessible to all relevant teams for review, evaluation, and updates.
6. **Collaboration and Innovation**
    - It is the joint responsibility of SOC, CTI, Threat Hunt, and other teams to present ideas for new detection rules, based on their observations of new threats, intelligence, and emerging trends.
    - The SOC should foster an environment that encourages innovation and proactive threat detection.
7. **Testing and Simulation**
    - Testing teams (Threat Hunt, Red Team, and Purple Team) must simulate real-world attack scenarios to validate detection rules and identify gaps.
    - The SOC must assess detection efficacy in these simulated environments and use feedback from these exercises to continuously refine and improve detection rules.
8. **Tuning and Adjustments**
    - Detection rules should be regularly tuned to balance the detection of true threats with the minimization of false positives.
    - Adjustments should be made to optimize the signal-to-noise ratio and improve the overall effectiveness of the detection system.

## Enforcement and Compliance
This policy aims to ensure that the SOC’s detection engineering efforts remain agile, effective, and aligned with organizational goals, helping to maintain a strong defense posture in the face of evolving cyber threats.  Cybersecurity leadership will be responsible for enforcing compliance with this policy.

## Policy Review
This policy will be reviewed annually by all employees to ensure its continued relevance and effectiveness. Feedback and suggestions for improvement are welcome and should be directed to the SOC Leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
