Reducing Dwell Time With Detection Engineering

Why dwell time still matters

Dwell time - the interval between initial compromise and detection - remains the single most useful operational metric for a defensive programme, because almost every downstream cost scales with it.

Public research consistently links faster identification and containment with lower total incident cost. IBM's Cost of a Data Breach report is a reasonable public reference point when you need an external citation; use its current-year figures rather than repeating older numbers.

The generic rule pack problem

Out-of-the-box rule packs are written for an average environment that does not exist. In a real estate they produce two failure modes at once: noisy alerts for benign administrative behaviour, and silence for the techniques that actually matter in your stack.

The remedy is unglamorous. Inventory your log sources, map them to the ATT&CK techniques that are plausible against your architecture, and write detections against the behaviour you can actually observe.

• Start from telemetry you already collect and trust
• Write one detection per behaviour, not per tool
• Validate every new detection with an authorised purple-team replay
• Retire detections that have never produced a true positive

Measuring detection quality

Alert volume is not a quality metric. Track true-positive rate, median time to triage and coverage of validated techniques instead.

detection_quality = {
  true_positive_rate,      # confirmed / total alerts
  median_time_to_triage,   # minutes
  validated_technique_cov, # % of in-scope ATT&CK techniques replayed
}