What it means
Threat-intelligence-driven detection engineering translates adversary behaviors, tools, infrastructure, and expected data into testable analytics and monitoring coverage.
Why it matters
The result should be a maintainable detection tied to a threat model, not a one-time indicator block.
Practical focus
- Map the behavior to available telemetry
- Write a clear analytic hypothesis
- Test with representative benign and malicious activity
- Track coverage, tuning, and retirement decisions
Common mistakes
- Creating detections without confirming data quality
- Using ATT&CK mappings as proof of effectiveness
- Ignoring false-negative scenarios
- Keeping stale indicator rules indefinitely
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: