Threat-Informed Detection

What is it?

Threat-informed detection prioritizes what to build based on real adversary behavior relevant to the organization — from threat intel, incidents, red-team results and ATT&CK — instead of building whatever is easy or trendy. It aims limited engineering time at the techniques most likely to be used against THIS organization.

Why it matters

Detection time is scarce; threat-informed prioritization spends it on the behaviors that actually threaten the organization, giving the most risk reduction per rule.

Where you see it

The detection backlog's priority order: driven by threat relevance, not by ease of implementation.

What normal looks like

A backlog where the top items are techniques seen in sector incidents or red-team reports, each justified by why it matters here.

What suspicious looks like

Not applicable directly — this is prioritization.

How analysts investigate

By sourcing detection ideas from real, relevant threat behavior and ranking the backlog by risk to the organization, not by how easy each rule is to write.

Common beginner mistakes

Building the easy detections first regardless of relevance — a backlog optimized for output looks productive while leaving the real threats uncovered.

Threat intel reports a campaign hitting Gulf banks with credential theft followed by wire-fraud tooling. Jisr is a Gulf bank. That report just re-ordered the detection backlog: the credential-access and the fraud-tool behaviors jump to the top, ahead of the easy-but-irrelevant rules an engineer might otherwise have built first. Relevance, not ease, sets the priority.

Quick check

Threat intel reports a campaign against your sector using technique X. How should this affect the detection backlog?

A quick self-check — it doesn't affect your XP or progress.