Prioritise the rule and the data it needs

The 26-item backlog covers detection, hunting, telemetry and other engineering work. I separated candidate rules from the monitoring or attribution they depended on and followed through on selected SQL, SMB and identity items. The backlog records the wider scope and the work still to progress.

MITRE ATT&CK Detection use-case development Attack-path analysis Telemetry requirements Security risk prioritisation KQL Microsoft Defender XDR SQL Server security SMB enumeration detection Credential exposure hunting Threat hunting Active Directory NTLM authentication

Return to the full story ←

Prioritise the rule and the data it needs

Viewed history

Ask about my work.