Phase 4 – Develop

The goal of this phase is to take technical specifications from the Investigate phase, then design, develop, and test a technical implementation for the relevant detection. The following are the inputs and outputs associated with this phase:

• Input: Detection of technical specifications
• Output: Detection code

As with most development work, this step requires rigorous planning. New detections need to not only satisfy the requirements but must also integrate with the rest of the detections within the environment. Detections are often implemented in the form of a query that is run against a data source or multiple data sources. Depending on your environment and its capabilities, different languages may need to interact with different data sources, and data pipelines and intermediary data stores may need to be built. The development process develops and implements a suitable solution for each new detection requirement, keeping both short- and...