Advanced International Journal for Research

E-ISSN: 3048-7641   •   Impact Factor: 9.11

A Widely Indexed Open Access Peer Reviewed Multidisciplinary Bi-monthly Scholarly International Journal

Call for Paper Volume 7, Issue 6 (November-December 2026) Submit your research before last 3 days of December to publish your research paper in the issue of November-December.
Submit Research Paper Join as a Reviewer

Plagiarism is checked by the leading plagiarism checker TurnItIn

Call for Paper

Volume 7 Issue 6
November-December 2026

Submit your research paper

Indexing Partners
Academia Advanced Sciences Index Bielefeld Academic Search Engine CiteSeer DRJI Google Scholar Independent Search Engine & Directory Network ISI (International Scientific Indexing) Issuu Mendeley Research Networks
RefSeek ResearcherId - Thomson Reuters ResearchGate Scirus Scribd Semantic Scholar Wiki for Call for Papers WorldCat Zenodo

SIEM Detection Engineering: A Survey of Practices, Challenges and Research Directions

Author(s) Mr. Jini Peter Fernandez
Country Saudi Arabia
Abstract Security Information and Event Management (SIEM) platforms remain the operational core of most Security Operations Centers (SOCs), yet their value depends less on the platform than on the quality of the detections built on it. Detection engineering, the discipline of designing, testing, deploying and maintaining detection logic, has emerged as a distinct practice, but the literature describing it is fragmented across academic venues, vendor documentation and practitioner reports. This paper surveys detection engineering for SIEM environments. We first describe the SIEM data pipeline and the detection lifecycle. We then propose a taxonomy of detection approaches, covering signature and correlation rules, behavioral and statistical analytics, machine-learning-based detection, and hunt-derived detection, and map them to the MITRE ATT&CK framework. We analyze recurring operational challenges, including false-positive volume and alert fatigue, data quality and normalization, detection coverage measurement, and the migration of content between SIEM platforms. The survey is complemented by a practitioner perspective drawn from more than ten years of SIEM engineering on enterprise and managed-security deployments. We conclude with open research directions, including verified detection migration, outcome-based coverage measurement, and the use of large language models in detection engineering.
Keywords SIEM, Detection Engineering, Security Operations Center, MITRE ATT&CK, Alert Fatigue, Threat Detection
Field Computer > Network / Security
Published In Volume 7, Issue 6, November-December 2026
Published On 2026-11-11
View / Download PDF File

Share this



E-ISSN 3048-7641
CrossRef

CrossRef DOI is assigned to each research paper published in our journal.

AIJFR DOI prefix is
10.63363/aijfr

Downloads
Research Paper Format Copyright Permission Form and Undertaking Form Cover Page Vol 7 Isu 6Cover Page Vol 7 Isu 4Cover Page Vol 7 Isu 3

All research papers published on this website are licensed under Creative Commons Attribution-ShareAlike 4.0 International License, and all rights belong to their respective authors/researchers.

CC-BY-SA Open Access

About AIJFR
Fees & Payment
Current Issue
Publication Archive 		Submit Research Paper
Track Submission Status
Publication Guidelines
Publication Ethics
Peer Review & Plagiarism 		Join as a Reviewer
Editors & Reviewers
Reviewer Referral Program
Get Reviewer Membership Certi. 		Website/Journal Policies
Usage Policy
Content Policies
Privacy Policy
Contact Us +91-9898-79-39-59 editor@aijfr.com