Identifying telemetry sources
Before monitoring our use cases, we need to locate appropriate sources to pull telemetry data from to make informed decisions on normal operations. What comes to mind for many detection engineers is capturing the immediate runtime data from the SIEM. Using the SIEM is definitely a major source for understanding alert frequency, runtime schedules, and disposition status.
Outside of the SIEM runtime, there are other opportunities to monitor detection life cycle health as well. Take the following examples:
- GitHub operations: On GitHub, the number of merge failures, issues, and warnings for each repo or detection set, including the number of times a detection has to be revised in a given week for tuning.
- Threat-based relevancy: Adding additional detections comes with a computational overhead. Depending on the organization, you can continuously reference threat intelligence reporting at the TTP level for deciding which detections to leverage...
