Discovering detection requirements
The first phase of the detection engineering lifecycle and our introduction to detection requirements is the Requirements Discovery phase. A proper approach to requirements discovery is important because it ensures that we are receiving context from outside our department that can guide development to provide the most value. Without connections to our stakeholders and clear guidance on how they can communicate detection requirements to us, we will spend more time tracking down employees and information than actually developing detections.
To recap Chapter 2, for each detection requirement, in order to turn a requirement into a design and, ultimately, into detection code, we need the following information captured as part of our Requirements Discovery phase:
- The Requesting Organization, that is, where the request originated
- A brief Description of what needs to be detected, either in technical or high-level terms
- The Reason for the...
