Use Cases & Detection Hypotheses
What is it?
A detection hypothesis is a testable statement of the form 'if technique T happens in our environment, it would appear in telemetry as observable O'. It bridges a threat behavior and a concrete detection: name the behavior, predict its telemetry footprint, and that prediction becomes the logic's target.
Why it matters
The hypothesis is what makes a detection buildable and testable: it says exactly what to look for and where, so the logic and the test cases both follow from it.
Where you see it
The bridge from a threat-informed requirement to concrete detection logic.
What normal looks like
A hypothesis predicting a specific, checkable telemetry observable for a named technique.
What suspicious looks like
Not applicable directly.
How analysts investigate
By writing the hypothesis explicitly (technique → predicted observable → data source), then deriving both the detection logic and its test cases from it.
Common beginner mistakes
- Writing logic before the hypothesis — without a predicted observable, there is nothing to test the rule against and no way to know it works.
Quick check
Which is a well-formed detection hypothesis?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.