Establish requirements

This is the start of the detection life cycle phase where engineering teams should determine what is in scope for the program and what qualifies as a useful detection to develop. What qualifies as useful input depends on what tools and available data are within the enterprise environment to leverage. Using the following table, we can map example inputs with possible detection outputs based on input requirements:

...

Common Requests	Inputs Needed	Possible Outputs
New Vulnerability Exploit Detection	Network or endpoint payload information Runtime logging Possible code-level changes of the patch	Endpoint detection response (EDR) signature Network intrusion detection system (NIDS) signature Runtime application security protection (RASP) signature