Scoping threat-based inputs
With the amount of threats and attack vectors, detection engineering needs to prioritize and determine which use cases to implement first. Utilizing a threat-informed defense strategy can help with this by providing curated details of IOCs, IOAs, and TTPs usually in the form of research and intelligence documentation. The problem with human-readable output is that not everything is machine-readable.
From an automation perspective, we have to select the highest-fidelity artifacts and parameters for use. Unless your organization has dedicated threat intelligence and security researchers on staff, you’ll likely be utilizing trusted sources of information that are machine-readable feeds.
Before moving on with this section, take a moment to get to know how threat intelligence teams operate to get a better understanding of how to utilize their data effectively. Although threat intelligence is not the focus of this book, you can read more about its...
