From Red to Blue, and Maybe Purple Too

A high level TTP to detection rule life cycle.

This is surely not all inclusive but does breakdown an often overlooked component of red team observations. That is, what happens once you hand off the report.

Example Detection “Package”