TIDeMEC : A Detection Engineering Platform Homegrown At The EC

This short talk introduces TIDeMEC, a detection engineering platform built inside the European Commission's security operations centre. The detection engineering team needed a way to connect high-level threat intelligence to the low-level detections written to find it, and to make that work repeatable. The project started as research in early 2022, moved into production later that year, and now handles most of the centre's detection operations.

The core of the platform is three linked models: threat vectors, threat detection models that describe the objective, and detection rules implemented as code. Because the models chain together, a team can start from any deployed rule, trace it back to the threat it detects, and reach the actors likely to use that technique. The talk also covered an automated data pipeline, a knowledge base generated from the models so documentation no longer has to be written by hand, and a deployment layer that pushes rules to multiple systems. It selects the right version for each context and can apply environment-specific modifiers, such as keeping notable events out of staging. A recent addition manages and validates lookups as code.

The speaker previewed plans to open source the framework and automation first, with detection content to follow depending on community interest. The release is targeted for the end of the year or early next year on the European Commission's code repository. An exploratory idea called TIDeX, aimed at connecting security operations centres that share threat intelligence, was also floated.