<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-threat-informed-detections
description: >-
  Build detections from cyber threat intelligence reports including
  TTP extraction, indicator analysis, adversary emulation scenarios,
  and detection rule development aligned to specific threat actors.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - threat-informed
  - cti-driven
  - adversary-emulation
  - ttp-extraction
  - ioc-analysis
  - threat-actor-profiling
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Threat Informed Detections

## Overview

Threat-informed detections align detection development with real-world
adversary behavior from CTI reports. Covers TTP extraction, indicator
analysis, adversary profiling, and detection rule development mapped
to specific threat actors and campaigns.

## Prerequisites

| Requirement | Purpose |
|---|---|
| CTI reports | Threat intelligence reports and advisories |
| ATT&CK Navigator | TTP mapping and visualization |
| Detection repository | Existing rule base for gap identification |

## Key Concepts

### CTI-to-Detection Pipeline

```python
cti_pipeline = {
    "input": "threat_intelligence_report",
    "steps": [
        {"step": "extract_ttps", "output": "attack_technique_list"},
        {"step": "map_to_attack", "output": "navigator_layer"},
        {"step": "check_coverage", "output": "gap_list"},
        {"step": "develop_detections", "output": "sigma_rules"},
        {"step": "validate", "output": "test_results"},
        {"step": "deploy", "output": "production_rules"},
    ],
}
threat_profile = {
    "actor": "APT29", "aka": ["Cozy Bear", "Midnight Blizzard"],
    "primary_ttps": ["T1566.001", "T1059.001", "T1078", "T1003.001"],
    "target_sectors": ["government", "technology", "think_tanks"],
}
```

## Workflow

1. **Ingest CTI** — Parse threat reports for TTPs and indicators
2. **Extract TTPs** — Map observed behaviors to ATT&CK techniques
3. **Check coverage** — Compare TTPs against existing detections
4. **Prioritize gaps** — Focus on techniques used by relevant actors
5. **Develop detections** — Author rules for uncovered TTPs
6. **Validate with emulation** — Test using adversary simulation
7. **Deploy and attribute** — Tag rules with threat actor context

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
