Detection Engineering Program - Part 2i - Threat Analysis and Identifying Detection Gaps (e.g., what detections do I create?)
Threat Analysis and Identifying Detection Gaps
Support Incident response
Cyber Threat Intelligence Threats
Exposure Gaps & Cyber Threat Intelligence
Threat Hunt Missions
Here are five clear, defensible reasons for creating a specific detection rule in a SIEM—focused on why that detection exists, not just what it does:
1. Detect Known Threat Behavior (Threat Intelligence–Driven)
You create a rule to identify activity tied to:
Known IOCs (IPs, domains, hashes)
Documented adversary TTPs
Trended environment baselines against Adversary TTPs
Why: To rapidly detect threats already observed in the wild and reduce time to detection for known attack patterns.
2. Close a Visibility Gap
A detection is created when:
A risk is identified (e.g., through threat modeling, audits, or hunts)
No existing telemetry or alerting covers that behavior
Why: To eliminate blind spots in the environment and ensure critical attack paths are monitored.
3. Support Incident Response & Triage
Some detections are built to:
Surface context during investigations
Identify precursor or follow-on activity
Why: To improve analyst efficiency and enable faster, more accurate scoping during incidents.
4. Enforce Policy or Compliance Requirements
Detections may be required to monitor:
Privileged access
Unauthorized changes
Specific regulatory controls (e.g., OMB M-21-31 logging expectations)
Why: To demonstrate control effectiveness and meet audit/compliance obligations.
5. Detect Anomalous or High-Risk Behavior
Rules are created to identify:
Behavioral deviations (e.g., unusual login times, data access patterns)
Risky but not strictly malicious activity
Why: To catch early-stage or unknown threats that don’t match known signatures.
Two Levels of Threat Analysis
Threat analysis operates at two levels:
Macro-Level Analysis: Evaluating detection coverage against a broad range of threats.
Micro-Level Analysis: Focusing on specific threats relevant to your organization.
Given the vast landscape of information technology and potential attack vectors, the most efficient approach is to ensure strong detections for threats directly targeting your organization. However, many organizations struggle to precisely identify their most relevant threats, and even those that attempt to do so often get it wrong. As a result, a more balanced approach is necessary, implementing broad detections for common attack techniques while also refining detections for specific, high-priority threats.
Macro-Level: Broad Detection Mapping
A common method for evaluating detection capabilities across a wide range of threats is mapping detections to the MITRE ATT&CK framework. While some argue that mapping to every technique is inefficient, it remains a useful exercise due to its comprehensive coverage of attacker tactics and techniques. Additionally, most cybersecurity tools already classify detections based on MITRE ATT&CK techniques, making this process more structured and valuable.
To maximize effectiveness, organizations should:
Tag their detection rules with corresponding MITRE ATT&CK techniques.
Use detection mapping as a guide rather than a rigid checklist.
Prioritize detections based on relevance to the organization’s threat landscape.
Micro-Level: Targeted Threat Detection
A more efficient approach begins with analyzing threats specific to your organization and ensuring adequate detection coverage for those threats. Even here, MITRE ATT&CK remains a valuable reference, as adversary tactics and techniques are mapped within the framework.
Two primary methods for conducting micro-level detection analysis include:
Tracking Threat Actor Techniques
Utilize resources like MITRE ATT&CK Navigator to identify techniques commonly used by known threat groups.
Overlay your existing detections against these techniques to identify gaps.
Prioritize detections based on threat actors most likely to target your organization.
Asset and Exposure-Based Detection
Instead of solely tracking threat actors, focus on your organization’s assets, systems, and operational risks.
Implement specialized detections such as deception techniques to detect targeted threats more effectively.
?????Mitre attack layers too,??????
Detect mapping detections to attack coverage:
Identifying the Root Cause of Detection Gaps
Once detection gaps are identified, it’s crucial to understand their root cause. Common reasons for detection gaps include:
Lack of Tool Instrumentation – The organization may not have the required security tools deployed to capture necessary data.
Incomplete Deployment of Instrumentation – Detection tools may exist but are not deployed across all critical systems, leading to blind spots.
Improper Audit Configuration – The security tools may not be set to capture the required audit logs to trigger detections.
Lack of Data Correlation – Relevant security events may be collected but not forwarded to a centralized system (e.g., SIEM), preventing effective correlation and alerting.
Missing Detection Rules – The necessary log data may exist, but no detection rules have been written to generate alerts based on that data.
?????detection gap causes????
Detection Development
good article siem ranking rules:
detection prioritization:
Writing rules and behavioral analytics for detecting known and unknown threats (e.g., YARA, Sigma, MITRE ATT&CK mappings).
What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK
Rule Hound:
Comments