Beyond the SIEM: Applying Data Science Rigor to Detection Engineering at Scale
No ratings
Presented at x33fcon 2026 by
Detection Engineering using traditional SIEM platforms excel at single item and first level correlation detections but struggle with more complex behavioral analysis. When I examined how other industries, such as business intelligence, marketing analytics, and fraud detection, approach large-scale analytical problems, I found they routinely apply data science techniques that are rarely operationalized in cybersecurity. This work explores how Detection Engineering can become more iterative, efficient, and scalable by treating security telemetry as a data analysis problem first, and a security problem second. Modern detection requires moving away from “security tools” as the center of gravity. In this model, multi-layer anomaly detection and behavioral analytics serve as the primary mechanisms for identifying suspicious activity, while Model Context Protocol (MCP) servers act as the investigation control plane and not as a magic button, but as a force multiplier for inherently hard problems. The key insight is simple: detection quality is bounded by the expressive power of the analytics layer. Rule engines and static correlation cannot answer behavioral questions such as, “Is this activity unusual for this entity compared to its peers over the past 90 days?” MCP servers transform security telemetry into callable investigation primitives, enabling agentic reasoning that remains bounded, inspectable, and enforceable through explicit policy constraints. This allows automated systems to gather context, evaluate evidence, and reason under uncertainty without relying on brittle playbooks or static decision trees. This approach acknowledges an uncomfortable truth: there is no “easy button” for cyber detection. Unsupervised anomaly detection will always surface rare-but-benign behavior, and automated response systems will struggle in environments dominated by uncertainty and incomplete context. Rather than fighting these realities, we embrace them by explicitly separating anomaly detection from investigative decision-making. Multi-layer anomaly detection narrows the search space from millions of events to hundreds of candidates, while agentic systems, grounded through MCP-based investigation primitives, automate evidence collection, contextual reasoning, and decision gating. The result is not perfect detection, but something more valuable: We’ve seen a 60–80% reduction in false positives and analyst effort without sacrificing sensitivity to genuinely malicious behavior. This session will demonstrate the architecture, share lessons learned from production deployment, and provide a practical framework for applying data science rigor to modern detection engineering programs. This session presents a practical approach to modern Detection Engineering that moves beyond traditional SIEM-centric thinking and toward data science–driven behavioral analysis. We will discuss Model Context Protocol (MCP) servers as an investigation control plane that enables automated, policy-bound evidence gathering and contextual analysis. By separating anomaly detection from investigative decision-making, MCP-grounded agentic systems can reduce noise while preserving sensitivity to genuinely malicious behavior.