Threat intelligence in the detection engineering life cycle

Threat intelligence can play a role in multiple phases of the detection engineering life cycle. In this section, we are going to look at how intelligence can be leveraged in the first three phases of the life cycle: Requirements Discovery, Triage, and Investigate.

Requirements Discovery

The first stage of the detection engineering life cycle is Requirements Discovery and it’s the phase in which various sources provide us guidance for what detections need to be developed. Either through the DE team’s own research or a threat intel team’s reporting, intelligence can become a source for detection requirements. For example, if a blog post comes out about a threat actor targeting organizations in your industry, it might become a requirement to ensure coverage for detecting the TTPs used by that threat actor. Or from an internal threat intel perspective, if threat hunters observe patterns of undetected...