Detection engineering is an ongoing process in which security teams deploy, tune, and manage logic rules that analyze system data for the purposes of detecting active threats in systems. When threats are found, alerts are generated, security analysts triage the alerts, and incident response and remediation processes are initiated if required. Detection engineering is only possible when an organization has a firm grasp on its IT infrastructure and the data it generates.