Ask two SOC leads what their SIEM should monitor and you'll often get two different answers: one shaped by a networking background, the other by systems administration. Both are reasonable. Neither is based on the threats the organisation actually faces. A threat-driven SIEM fixes that by letting adversary behaviour, not personal experience, set detection priorities.
Start with value: data in, security value out
A SIEM earns its cost through alerts, dashboards, reports, threat hunts and investigations. If a data source doesn't support at least one of those, it probably doesn't belong in the SIEM. The real question is which detections, reports and hunts you need. That question should be answered by threat intelligence.
Use threat intelligence to choose what matters
- Identify likely threat actors based on your industry, geography, technology stack, major projects and past incidents.
- Collect their TTPs (tactics, techniques and procedures) from threat intelligence and MITRE ATT&CK.
- Find the overlap. Techniques used by several relevant actors are your highest priorities.
- Visualise it. Overlay actor profiles in the MITRE ATT&CK Navigator to build a heatmap of the techniques most likely to be used against you.
Turn intelligence into detections
- Design detection logic for each priority technique that fits your environment, ideally as portable Sigma rules.
- Define SIEM use cases: detections, dashboards, reports and hunting queries.
- Map data requirements using MITRE ATT&CK data sources, so you know exactly which logs and fields each use case needs.
- Onboard sources deliberately, in priority order, through a security data pipeline instead of ingesting everything.
- Test each detection against emulated attacker behaviour before it goes live.
Make it a recurring cycle
The threat landscape changes, so detection priorities must too. Start with a quarterly review of threat actors, techniques and coverage, and work towards a monthly cadence: twelve focused improvements a year instead of one big project that goes stale.
What you gain
- Higher-fidelity alerts, because detections target techniques that matter.
- Lower SIEM cost, because only data that powers a use case is ingested.
- Defensible coverage reporting for auditors and boards, mapped to MITRE ATT&CK.
Learn how we run this as a service in detection engineering.
Frequently asked questions
What is a threat-driven SIEM?
A SIEM whose detections, dashboards and log sources are prioritised by the threat actors and techniques most likely to target the organisation, rather than by habit or by ingesting everything.
How often should detection priorities be reviewed?
At least quarterly, and ideally monthly, or whenever there's a major change in the threat landscape, your environment or your regulatory obligations.