Summary

In this chapter, we went into greater depth on the concept of threat intelligence and, specifically, its role in detection engineering. First, we introduced the types of threat intelligence at a very high level. We then looked at how we can leverage this threat intelligence during the Requirements Discovery, Triage, and Investigate phases of the detection engineering life cycle, using examples to solidify the concepts. Finally, we touched on threat assessments and how a threat assessment combined with threat intelligence can lead to important detection requirements.

In the next chapter, we will discuss performance management. This chapter will look at leveraging metrics to both identify the current state of your detection engineering program and road-map improvements to your program.