🎯 DART
Intelligent Detection, Response and Analysis of Security Events
Helping SMEs, non-profits and their service providers build feasible, NIS2-aligned detection and incident response capabilities. A TETRA project funded by VLAIO.
Focus areas
Risk & compliance
Translating NIS2, GDPR and frameworks such as NIST CSF 2.0 and CyFun® into concrete, proportionate technical requirements.
Detection
Baseline detection, threat intelligence and detection-as-code templates for a reproducible security monitoring setup.
Triage & response
Decision trees, playbooks-as-code and AI assistance to reduce alert fatigue and shorten the time from detection to response.
Post-incident
Templates for legal incident reporting and structured post-incident analysis that feeds lessons learned back into detection.
Across the incident lifecycle
Pre-incident
Detect: prioritised data sources, rule-based detection and automated configuration and rollout of security tooling.
At-incident
Respond: fast, proportionate triage, containment and response, whether handled in-house or outsourced.
Post-incident
Analyse: correct and timely reporting to authorities (CCB/GBA) and structural lessons learned.
About DART
DART closes the gap between what regulation expects of detection and incident response and what Flemish SMEs and non-profit organisations can realistically do. Through practice-oriented research, the project delivers context-aware guidelines, methodologies and reference architectures that help these organisations and their service providers organise detection and response in a feasible way.
The challenge
With the NIS2 directive, European organisations, including many Flemish SMEs, face growing pressure to strengthen their cyber resilience. Many have taken measures to identify and protect, but detection and incident response remain the least mature parts of their security approach.
At the same time, ICT environments keep getting more complex. Cloud, network, IoT and industrial (OT) environments generate large volumes of security events. That data makes fast detection possible, but most SMEs and non-profits lack the expertise and resources to use it. Available security solutions are often built for large enterprises and don’t match the cost, complexity or skills of smaller organisations. Security teams struggle with alert fatigue, while dwell time, the time an attacker stays unnoticed, remains too high.
Our approach
The building blocks already exist. What is missing is their translation to the SME context. DART focuses on lowering the operational burden through context-specific configuration and automation, rather than adding more and larger tools. Concretely, the project explores:
- Detection-as-code and configuration-as-code for reproducible, verifiable security setups
- Playbooks-as-code for automated containment of common, low-risk incidents
- Generative AI and AI agents as a “copilot” that turns natural-language risk descriptions into detection rules, and that supports triage and filtering of false positives
- Tool-agnostic, open standards wherever possible, so results don’t depend on one vendor
Target groups
The project addresses three sub-target groups:
- Cybersecurity and IT service providers and integrators: need scalable, modular methods to offer detection and response services cost-effectively to many smaller clients
- Organisations with in-house or hybrid security operations: monitor their environment but lack the resources for a 24/7 SOC or complex enterprise tooling (SIEM, SOAR)
- Organisations in the awareness phase: have not yet implemented detection and response, and are reached through targeted knowledge dissemination
Expected results
- A practical framework for interpreting and prioritising cyber risks and legal obligations around monitoring, incident handling and reporting
- Practical guidelines for setting up security operations in line with risk profile, maturity and available resources, without compromising compliance
- Standardised workflows and playbook templates for triage and response, usable without a permanent SOC or specialised security experts
- Reference architectures for detection and alert processing, focused on filtering, correlation and contextual enrichment of alerts
- A practical security guide, “From Detection to Response”, bundling all insights, guidelines and tools
All results are validated in representative cases together with members of the advisory group, and are made publicly available as open source at the end of the project.
Partners
This TETRA project is carried out by:
- KU Leuven – DistriNet, Campus Gent (project lead): secure distributed systems, IoT, network security, cybersecurity standards and AI for security
- Vrije Universiteit Brussel – Software Languages Lab (SOFT): event-driven architectures, rule-based systems and declarative programming
The project is funded by VLAIO (Flanders Innovation & Entrepreneurship) within the TETRA programme, using earmarked funds of the Flemish Cybersecurity research programme.