# Intelligence Driven Detection and Defensive Recommendations

> Turn adversary behaviour into detections and prioritised defensive actions: from TTPs to Sigma and YARA rules, coverage measured against ATT&CK, and recommendations ranked by risk reduction.

Canonical: https://codelivly.com/rooms/cti-intelligence-driven-detection
Last updated: 2026-10-28

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

Purpose: make intelligence change what defenders detect and prevent. This module shows how to analyse reported adversary procedures, identify the data sources needed to see them, express detection logic as Sigma rules (log based) and YARA rules (file and content based), measure detection coverage against MITRE ATT&CK honestly, and prioritise defensive recommendations.

Prerequisites: the four earlier paths of the Threat Intelligence Analyst career path (in particular ATT&CK mapping from path 3 and SOC integration from path 4), and modules 1 and 2 of this path. Basic familiarity with Windows logging and reading YAML is helpful.

Measurable outcomes. After this module you can:
- Decompose a reported procedure into technique, observable behaviour, data source and detection idea, and place it on the Pyramid of Pain.
- Read and write a syntactically valid Sigma rule and explain its logsource, detection and condition sections.
- Read and write a simple YARA rule and predict which files it matches.
- Build a coverage view of an actor's techniques that distinguishes validated, untested and missing detections, without inventing coverage figures.
- Rank defensive recommendations with a documented method and justify the order.

Practical completion objective: complete the lab by turning a fictional intelligence report into a scored detection backlog and writing a Sigma rule for the top persistence gap.

## Lessons

1. From TTPs to Detections (18 min)
2. Sigma Rules for Intelligence Driven Detection (20 min)
3. YARA Rules: Concepts and Safe Practice (18 min)
4. Detection Coverage and Prioritising Defensive Recommendations (18 min)
5. Lab: From Intelligence Report to Detection Backlog (50 min)

## Related

- [Learning path: Advanced Intelligence Analysis and Reporting](https://codelivly.com/learning-paths/cti-advanced-analysis-reporting)
- [All rooms](https://codelivly.com/rooms)