Detection mechanisms
Modern security platforms layer many kinds of Detection Logic The rule, model, or heuristic that decides whether a given input fires an alert. The logic that produced the alert matters as much as the alert it produced; two engines can name the same alert for very different reasons. on top of each other. ASSURED groups them into four families. The grouping is this methodology’s teaching taxonomy, not an industry standard (NIST SP 800-94, for example, cuts the space differently), but it maps cleanly onto how alerts arrive in practice. Each family is good at something specific and blind to something else. Used together they cover far more ground than any one of them could on its own. When an alert arrives, the first question an analyst asks is which mechanisms produced it — plural on purpose. Real detections are often hybrids: a deterministic Sigma rule that encodes a behavioral parent-child sequence is both rule-based and behavioral, and a “signature” hit may be one condition inside a larger correlation. The families are lenses for reading a detection, not boxes it must fit into, and naming the family is the start of reading the rule that actually fired, never a substitute for it.
Why provenance matters
A high-confidence signature hit on a known Command and Control (C2) Infrastructure used by attackers to communicate with and control compromised systems within a target network. binary is one alert. A behavioral anomaly suggesting unusual PowerShell A command-line shell and scripting language built on the .NET framework, commonly used for system administration and potentially for malicious purposes. child processes is a different alert, even when the underlying activity is the same. The first deserves an immediate response. The second deserves correlation and context first. Detection provenance is what tells the analyst which kind of alert they have in front of them.
The four families at a glance
🔍 Signature-based
Pattern matching against known indicators. Fast, precise, useless against anything novel.
Read →📊 Anomaly-based
Statistical deviation from a behavioral baseline. Catches the unknown. Noisy during change.
Read →⚖️ Rule-based
Expert-defined conditional logic combining multiple indicators. Tunable, auditable, demanding to maintain.
Read →🧠 Behavioral analytics
Multi-event sequence analysis across users, hosts, and time. Built for stealth attacks.
Read →The grid behind the four families
The families are the corners of a 2×2. One axis is how the logic is produced: signature and rule conditions are written by humans; anomaly and behavioral models are learned from data. The other axis is what the logic evaluates: signature and anomaly judge a single event; rule and behavioral evaluate combinations and sequences. That grid is why Snort content matching sits under signature while a Sigma correlation rule sits under rule, even though both are “rules” in everyday speech. And real detections regularly occupy more than one corner: a hand-written rule whose conditions describe a behavior sequence (a LOLBin parent-child chain, say) is rule-based and behavioral. When a detection fits two corners, name both — the point of the label is to tell the next reader what kind of logic to inspect, not to win a classification argument.
Trust calibration
Each family carries a different prior — a starting posture, useful for the first thirty seconds and no longer. The mechanism label alone never determines confidence: that comes from the actual rule logic, the telemetry behind it, and the rule’s measured performance in your environment. Before translating any label into trust, check the local calibration facts: the rule’s version and last review, its precision here (what fraction of its recent fires were real), what it is known to miss, how common the matched artifact is in this environment, and whether suppressions or exceptions are currently active on it.
Key Takeaway
Mastery of detection mechanisms is not memorizing each family. It is the habit of asking which mechanisms produced the alert — accepting that the honest answer is often two — then reading the rule that fired and its local track record before deciding how much to trust it. The four deep-dive pages below are reference material, not required reading. Skim the family that matches whatever fires most in your environment, then return to the others when an unfamiliar family shows up.
Next up
Signature-based (reference)
The oldest and most precise of the four families: deterministic pattern matching against curated indicators of compromise. Read on-demand when a signature alert fires, or skim now if signatures dominate your alert volume.
Browse signature-based