🎯 Introducing Detection Objective Models

[behemothsecurity]

🎯 Detection Objectives

Detection Objectives are the next generation OpenTide construct to model detections, and replaces the monolithic previous Cyber Detection Models and Business Detection Requests with a new composable blend of signals, and adds a new Visibility configuration to model logsource and asset coverage on top of threat coverage.

✨ Features

📡 DOM = Objective+Signals

Detection Objectives enable modelling a higher level desired detection capability compared to the previous Detection Model concept, while enabling lower level analysis and description. By extending the range of the DOM, it is easier to go from threat to identify objective and opportunities, and codify them

• Each signal gets its own UUID and is referenceable by detection rules for precise coverage mapping
• Signals are independent ideas for detections, which may leave independently or aimed at being grouped (see composition)
• Enable to break down a high level objective into detailed signal specs

🎼 Composition

Declare how signals should be assembled into higher fidelity incident - or don't !

• Enables more complex strategies
• Structures an initial composition vocabulary to help drive ideas
• Extensible as research evolves

🔎 Visibility

A new way to catalogue your data inventory, including external detectors tools like AWS guardduty, while exposing it to signals for mapping

• Declare assets to map out your data coverage
• Catalogue logsources across systems and tenants in a flexible way
• Inventorize your external detectors to reference them under signals, indicating coverage

👉 Read More

Full Article : Introducing OpenTide Detection Objectives
Check out an example Detection Objective : Detect Abuse of Valid Azure Credentials

---

This discussion was created from the release 🎯 Introducing Detection Objective Models.