Choosing the Right Detection Approach

This article was co-authored by Gary Katz and Jason Deyalsingh

In the prior article , we examined how Visibility, Detections, the Environment, and Threat Intelligence can each serve as starting points for identifying new detection opportunities, as well as how they can be used to filter and prioritize the detections worth pursuing. Having identified an opportunity, the next question is how best to detect it.

This follow-on article delineates the different detection capabilities available to detection engineers, providing a framework for evaluating which technique is most appropriate for a given activity. There is no clear-cut answer. Different detection techniques require different types of data and levels of effort, while offering different tradeoffs in robustness, coverage, and complexity.