<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-threat-informed-defense
description: >-
  Implement threat-informed defense strategies by mapping organizational threat
  landscape to detection and mitigation priorities. Covers CTI integration,
  ATT&CK-based gap analysis, defense prioritization matrices, and continuous
  alignment of security controls with evolving threat actor TTPs.
domain: cybersecurity
subdomain: purple-team
tags:
  - threat-informed-defense
  - mitre-attack
  - cti
  - threat-intelligence
  - defense-prioritization
  - attack-navigator
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1003.001", "T1003.003", "T1053.005", "T1059.001", "T1059.003", "T1566.001", "T1566.002"]
---

# Implementing Threat-Informed Defense

## Overview

Threat-informed defense prioritizes security investments based on which adversaries
target your sector and which techniques they actually use. Instead of defending
everything equally, this approach maps threat intelligence to ATT&CK, identifies
coverage gaps for the most relevant threats, and drives detection engineering and
control implementation toward the highest-risk TTPs.

## Prerequisites

| Requirement | Install |
|---|---|
| ATT&CK Navigator | `git clone https://github.com/mitre-attack/attack-navigator.git` |
| MITRE ATT&CK STIX data | `git clone https://github.com/mitre-attack/attack-stix-data.git` |
| Python 3.10+ | For agent tooling |
| mitreattack-python | `pip install mitreattack-python` |
| Sigma CLI | `pip install sigma-cli` |

## Key Concepts

### Threat Profile Matrix

```yaml
threat_profile:
  organization_sector: financial-services
  geography: north-america
  priority_groups:
    - group_id: G0016
      name: APT29
      relevance: high
      techniques:
        - T1566.001  # Spearphishing Attachment
        - T1059.001  # PowerShell
        - T1003.001  # LSASS Memory
        - T1053.005  # Scheduled Task
    - group_id: G0045
      name: menuPass
      relevance: medium
      techniques:
        - T1566.002  # Spearphishing Link
        - T1059.003  # Windows Command Shell
        - T1003.003  # NTDS
  current_coverage:
    detected: [T1059.001, T1003.001]
    partial: [T1566.001]
    gaps: [T1053.005, T1566.002, T1059.003, T1003.003]
```

### ATT&CK Coverage Heatmap

```python
# Generate coverage heatmap using mitreattack-python
from mitreattack.navlayers import Layer, Technique

layer = Layer()
layer.name = "Financial Sector Threat Coverage"
layer.domain = "enterprise-attack"

for tech_id in detected_techniques:
    t = Technique()
    t.techniqueID = tech_id
    t.color = "#00ff00"  # Green = detected
    t.score = 100
    layer.techniques.append(t)

for tech_id in gap_techniques:
    t = Technique()
    t.techniqueID = tech_id
    t.color = "#ff0000"  # Red = gap
    t.score = 0
    layer.techniques.append(t)
```

### Defense Prioritization Score

```
Priority = (Threat Relevance × Technique Frequency × Impact) / Current Coverage
```

| Factor | Weight | Source |
|---|---|---|
| Threat relevance | 0.35 | CTI reports, sector targeting |
| Technique frequency | 0.25 | ATT&CK usage statistics |
| Impact potential | 0.25 | Business impact assessment |
| Current coverage | 0.15 | Existing detection/prevention |

## Workflow

### 1. Identify Relevant Threat Actors

```bash
# Query ATT&CK STIX for groups targeting financial sector
node agent.js identify-threats \
  --sector financial-services \
  --geography north-america \
  --output threat_profile.yaml
```

### 2. Map Techniques to Coverage

```bash
# Generate gap analysis
node agent.js gap-analysis \
  --threat-profile threat_profile.yaml \
  --detection-rules rules/ \
  --output gaps.json

# Generate ATT&CK Navigator layer
node agent.js generate-heatmap \
  --threat-profile threat_profile.yaml \
  --coverage-data gaps.json \
  --output navigator_layer.json
```

### 3. Prioritize Defenses

```bash
# Score and rank techniques by priority
node agent.js prioritize \
  --gaps gaps.json \
  --output prioritized_defenses.json
```

### 4. Generate Detection Backlog

```bash
# Create ordered detection engineering backlog
node agent.js generate-backlog \
  --priorities prioritized_defenses.json \
  --sigma-rules rules/ \
  --output backlog.json
```

### 5. Track Progress

```bash
# Measure coverage improvement over time
node agent.js track-progress \
  --baseline baseline_coverage.json \
  --current current_coverage.json
```

## Detection

```yaml
title: Threat Informed Defense Detection
id: 66d71f94-146a-4a1c-a4f5-674ca306fd8f
status: experimental
description: Detects suspicious activity related to implementing threat informed defense techniques in purple team context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*threat*"
  condition: selection
level: medium
tags:
  - attack.t1003.001
  - attack.t1003.003
  - attack.t1053.005
  - attack.t1059.001
  - attack.t1059.003
  - attack.t1566.001
  - attack.t1566.002
  - attack.defense_evasion
falsepositives:
  - Authorized adversary simulation exercises during scheduled windows
```

## Verification

| Check | Method |
|---|---|
| Threat profile complete | All priority groups have technique mappings |
| Gap analysis accurate | Manual review of coverage claims |
| Priority scores reasonable | Top items match analyst intuition |
| Backlog actionable | Each item has implementation guidance |

## References

- [MITRE ATT&CK](https://attack.mitre.org/)
- [Center for Threat-Informed Defense](https://ctid.mitre-engenuity.org/)
- [ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/)
- [Top ATT&CK Techniques](https://top-attack-techniques.mitre-engenuity.org/)
