Revisiting the phases of detection requirements
In Chapter 2, we introduced the detection engineering lifecycle, shown again in Figure 5.1. The first phase of the lifecycle is the Requirements Discovery phase. In that section, we touch on the characteristics of a complete detection requirement as well as the sources of detection requirements. The second phase of the lifecycle is the Triage phase, which involves taking the detection requirements from the first phase and deciding which should be prioritized. Investigate is the last phase before actually turning our detection requirements into detection designs and code. During this phase, we perform four key steps: identify the data source, determine the detection indicator types, research the requirement, and establish validation criteria.
Figure 5.1 – Detection engineering lifecycle
In the following sections, we are going to go into more detail on each of those phases and provide exercises that...
