Summary

In this chapter, we learned how to scope and prioritize what artifacts are needed from a threat-informed defense strategy as inputs for use case detections. We then found ways to automatically parse valuable payloads that can be used in detection from research and intelligence sources using Python.

There were various labs on how to automatically ingest various IOCs or IOAs in different security tools, as well as, finally, wrapping up by analyzing and customizing detections using the threat intelligence enrichments. When using SDKs and APIs, we were able to automate and filter high-fidelity threat sources to bolster or create new use cases.

In the upcoming chapter, we will shift our automation focus toward the infrastructure of deploying use cases at scale using a CI/CD pipeline. We’ll learn how to make use of vendor-provided APIs to drive a detection as code workstream.