Detection Strategies

Overview

Threat detection identifies suspicious, malicious, or unauthorized activity that may indicate a cyberattack — blue teams combine multiple data sources to tell real incidents from noise.

Key concepts

Signature, behavior, anomaly, and rule-based detection
Correlation, threat hunting, threat intelligence
IOCs vs. IOAs, false positives/negatives

How it works

Threat detection is the process of identifying suspicious, malicious, or unauthorized activity that may indicate a cyberattack or security incident. Blue teams combine logs, endpoint data, network activity, user behavior, threat intelligence, and security policies to determine whether suspicious activity is a real incident.

Detection approaches

Approach	How it works
Signature-based	Matches activity against known malware signatures, malicious domains, file hashes, IPs, or attack patterns.
Behavior-based	Detects suspicious actions or patterns even when the specific malware/attacker is unknown.
Anomaly-based	Identifies activity that differs from an established normal baseline.
Rule-based	Triggers an alert when a predefined condition occurs (e.g. repeated failed logins then a success).
Correlation	Combines multiple events from different sources to identify a larger pattern.

Intelligence & indicators

Term	Meaning
Threat hunting	A proactive search for signs of malicious activity that automated alerts may have missed.
Threat intelligence	Information about known threats, malicious infrastructure, malware behavior, and IOCs.
Indicator of compromise (IOC)	Evidence a system may have been attacked — a malicious hash, suspicious domain, unusual process, unauthorized account.
Indicator of attack (IOA)	Evidence of suspicious behavior tied to an attack — abnormal credential access, unusual admin tool use.
False positive	An alert that looks malicious but is actually harmless.
False negative	A real security event the detection system fails to identify.