Threat detection and response is the ability to notice signs of an attack, decide what they mean, and act to contain and recover. It is a loop of telemetry, analysis, decision and action. Build it by choosing the attacks you most fear, then proving you would see and stop each one.
What are the moving parts?
NIST SP 800-61 Revision 3 organizes incident response around the six functions of the NIST Cybersecurity Framework 2.0. Three of them describe this topic directly. Detect means possible cybersecurity attacks and compromises are found and analyzed. Respond means actions regarding a detected incident are taken. Recover means affected assets and operations are restored. Govern, Identify and Protect sit behind them, and help prevent incidents, prepare for the ones that happen and improve over time.
In plain terms, you need:
- Telemetry. Logs and signals from endpoints, identity systems, cloud accounts, networks and applications.
- Detection logic. Rules and models that turn signals into alerts.
- Triage. A person or process that decides which alerts matter.
- Response actions. Isolate a device, disable an account, revoke a token, block a domain.
- Recovery and learning. Restore service, find the cause, and improve detection.
Where do you start?
Not with tools. Start with a short list of attacks that would hurt your organization. Then use a shared vocabulary to describe them. MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations, used by the private sector, government and the security product community. Each technique has a page describing what it is, which platforms it affects and how it may be detected and mitigated.
For each attack on your list, ask three questions. Which technique is it? What would we see in our logs if it happened? Who would act, and how fast?
A constructed example: a company worries about ransomware. ATT&CK's page on Data Encrypted for Impact (T1486) describes adversaries encrypting data on target systems to interrupt availability, and notes they may first need other behaviors, such as changing file permissions or shutting down systems. The team maps what is earlier in the chain. They find they log process launches on laptops but not on file servers, and have no alert when a backup service stops. Those two gaps become the first fixes.
What makes detection good?
Coverage, quality and speed. Coverage means the important techniques have at least one detection. Quality means alerts are specific enough that a person will act on them. Speed means the time from first signal to action is short enough to matter.
Measure these. Track how many alerts per week led to action, how long triage took, and how long containment took after confirmation. If every alert is a false alarm, the team learns to ignore them, which is worse than having none.
Who acts, and with what authority?
Detection without response authority is a notification system. Decide in advance which actions the analyst may take alone, such as isolating a laptop, and which need approval, such as shutting down a production service. NIST's guide notes that leadership may hold decision authority over high-impact actions. Put those decisions in a short playbook, with named people and fallback contacts.
Automation helps with repetitive steps: enrich an alert with context, disable a stolen token, open a ticket. Keep a person in charge of decisions that are hard to undo.
How to check or apply this
- List the five attacks that would hurt most: for example ransomware, account takeover, stolen cloud keys, data theft and a compromised build pipeline.
- Map each to ATT&CK techniques and write what you would expect to see in logs.
- For each, confirm the logs exist and where they are stored. Fix the blind spots first.
- Write one detection per technique you can, test it with a safe, authorized simulation and record the result.
- Define response actions with who may take them alone and who must approve.
- Track alert count, share that led to action, time to triage and time to contain.
- Review after every incident and exercise. Add or retire detections based on what you learned.
Quick check
What is the difference between detection and response?
Detection finds and analyzes possible attacks. Response takes action on a confirmed incident, such as containing it. Recovery then restores affected systems and operations.
How does MITRE ATT&CK help?
It gives a shared, evidence-based vocabulary of adversary tactics and techniques so you can map attacks to the signals you need and find detection gaps.
Sources
- NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- MITRE ATT&CK
- MITRE ATT&CK, Data Encrypted for Impact (T1486)
Last reviewed: 18 October 2026.
