-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating

Practical Threat Detection Engineering
By :

As the backlog for requirements increases, a Triage phase is required to identify what detection should be focused on next. The following are the inputs and outputs associated with this phase:
In most circumstances, dependencies do not exist between detection requirements, allowing the DE team to choose the next appropriate task from the backlog. Using a first-in first-out queue or predefined priority is not preferable as these methods will not consider the changing external threat landscape and internal attack surface. In Chapter 10, we will review performance management techniques that influence the Triage phase. The Triage phase can depend upon several factors, including the following: