Detection: did your tools see the test?

Most organisations read the findings and stop there. The test also contains a second question: did anyone notice?

What to ask after a test

1. Ask the testers for the exact times and actions of key steps.
2. Compare them with your logs and alerts. Which actions left a trace? Which raised an alert?
3. Note the gap between the action and the alert, if there was one.
4. For each undetected step, decide whether a rule, a log source or a process is missing.

Why it matters

Prevention will sometimes fail. The time between an intruder's first step and your reaction is often what decides the damage.

Keep it light

You do not need a new project. A one-hour review with the testers and your operations team usually produces three or four concrete changes to detection.