Review — The Detection Brief

What is it?

A review of Module 1 assembled into a detection brief: a threat-informed requirement, a testable hypothesis with its predicted observable and data source, and a place in the lifecycle — everything needed before writing a line of logic.

Why it matters

The brief is what separates an engineered detection from a lucky script: it defines success before the work starts.

Where you see it

The first artifact of every detection.

What normal looks like

A brief with requirement, hypothesis, data source and success criteria, all before logic.

What suspicious looks like

Not applicable at review level.

How analysts investigate

By assembling the requirement, hypothesis and data source into one brief that testing and tuning can later be measured against.

Common beginner mistakes

Writing a detection brief with no data source named — the most common way a promising detection stalls when the data turns out not to exist.

Assemble Jisr's first detection brief from the intel: requirement (detect the reported credential-theft behavior), hypothesis (technique → predicted observable → data source), success criteria (fires on the malicious fixture, silent on the benign one). This brief is the target everything downstream — logic, tests, tuning — will be measured against.

Quick check

Which detection brief is complete enough to start engineering?

A quick self-check — it doesn't affect your XP or progress.