Summary
In this chapter, we provided an overview of validation as it relates to assessing the maturity of a detection engineering program. We then introduced a series of open source tools that can be leveraged by organizations without purple teams to perform validation tests easily and effectively. The exercises in the chapter leveraged some of these tools to simulate adversary activity in order to validate detections. Finally, we concluded the chapter by explaining how the results of validation tests can be leveraged to improve your detection posture.
In the next chapter, we will take a look at the topic of threat intelligence. We’ll discuss the different types of threat intelligence and the roles they can play in detection engineering.
