[RESEARCH] 01 Detection Engineering Foundations #10

Module

01 Detection Engineering Foundations

Target directory: core/01-detection-engineering-foundations/

Purpose

Establishes what detection engineering is, the vocabulary used throughout Core, and the end-to-end detection lifecycle that the remaining modules expand on. Every other module builds on the definitions set here.

Goal of This Issue

Design the module's structure so individual lessons can be claimed and written. This issue does not produce lesson content.

Research is complete when a pull request is merged that adds:

• core/01-detection-engineering-foundations/README.md, based on templates/module-template.md, containing:
  • module learning objectives
  • prerequisites
  • the proposed lesson list, with for each lesson:
    • 2–4 learning objectives
    • key topics
    • explicitly out of scope
  • a Boundaries section describing what this module covers versus adjacent modules
• core/01-detection-engineering-foundations/module-metadata.yml, based on templates/module-metadata.yml, with status: draft

Once merged, a maintainer opens one issue per lesson as a sub-issue of this one.

Inputs

Community Feedback

• None yet. See the Core curriculum discussion.

Seed Material

• TBD

References

Starting suggestions. Add, remove, or replace as research progresses.

• MITRE ATT&CK — https://attack.mitre.org/
• Pyramid of Pain (David Bianco)
• Alerting and Detection Strategy (ADS) framework (Palantir)
• Detection Engineering Maturity Matrix (Kyle Bailey)

Known Overlaps

Topics that touch adjacent modules and need an agreed boundary.

How to Participate

• Claim: comment on this issue to join. A maintainer will assign you and add you to the Contributors section below. Multiple contributors may claim the same research issue.
• Lead: a maintainer designates one contributor as lead. The lead coordinates, keeps work moving, and opens the pull request. The lead does not make every decision alone.
• Suggest inputs: only maintainers can edit this issue, so post feedback, seed material, references, or overlaps as comments and a maintainer will add them above.
• Collaborate: use this issue to coordinate. The lead forks the repository and opens a draft pull request early so everyone works from the same document. To let co-contributors push to that branch, the lead adds them as collaborators on their fork (fork Settings → Collaborators). Contributors who are not added can propose edits with suggested changes in the pull request review. Every commit must be signed off (DCO).
• Boundary review: before merging, a contributor from each adjacent module, or a maintainer, confirms the Boundaries section.
• Inactivity: claims with no activity for 4 weeks may be released after a reminder.

Contributors

Lead:

Contributors: @mndtrcks, @sh0k03

Additional Context

This module sets the shared vocabulary for Core. Adjacent research groups may want to check terminology choices here early.

Questions or want to coordinate in real time? Join the ODE Discord. Record decisions here or in the pull request.