Scoping and Automating Threat-Informed Defense Inputs

Now that we’ve successfully planned an automation process and milestones around our detection engineering work, we can focus on critical inputs that will help us prioritize what use cases to build first and the type of automation possibilities that can help our organization even before deploying a full CI/CD pipeline. Detection engineering teams need threat-focused artifacts for the development of use cases.

This chapter focuses on prioritizing and applying automation to extract essential components for utilization in threat-focused use cases. We will cover how to automate time-consuming efforts in artifact collection and understand how to apply and enrich existing detections with threat intelligence.

By the end of the chapter, you will be able to automate IOC parsing and apply IOCs directly to security defense tooling, as well as understand how to create use cases using threat and business-specific enrichment.

In...