Prioritization
5.1 The six inputs#
| Input | Scale | Question |
|---|---|---|
| threat_relevance (T) | 1 to 5 | How recently, and how close to you, has this technique been used? |
| impact (I) | 1 to 5 | What does the attacker reach if the technique succeeds? |
| robustness (B) | 1 to 5 | How hard is it for an attacker to slip past this rule using the data you have? Score it with the five Summiting the Pyramid levels: 1 matches something the attacker can change in seconds, 5 matches something the technique cannot work without. |
| telemetry_readiness (R) | 0 to 5 | Is the data this rule needs already in the SIEM, and in good enough shape to use? |
| build_effort (E) | 1 to 5 | How many hours of work from writing the hypothesis to passing validation? |
| run_cost (C) | 1 to 5 | How many analyst minutes a day will this rule consume? Expected alerts per day multiplied by the typical minutes to triage one. |
Robustness uses the five Summiting the Pyramid levels: the higher the level, the more an attacker has to change to get past the rule. Run cost is the alerts expected per day multiplied by the typical minutes to triage one. The 1 to 5 wording for every input is in Appendix B.
5.2 The formula#
value = wT·T + wI·I + wB·B. cost = wE·E + wC·C. score = (value / cost) × (R / 5)^k.
A readiness of 0 sets the score to 0 and marks the rule blocked. Scores round to two decimals. With every weight at 1 and k = 1, scores run from 0.06 to 7.50. The shape is Weighted Shortest Job First from SAFe, value over size, with readiness added as a gate because a detection cannot be built on data that is not there.
5.3 Four ways to lean#
| Preset | Change | Use when | Where it goes wrong |
|---|---|---|---|
| balanced | none | The default. One score for the whole backlog. | Only as good as the six numbers, so every number needs its evidence line. |
| threat_led | wT=2 | You have your own incident history or strong reporting about your sector. | Ranks by what attackers do, so it can pull effort toward techniques your logs cannot see yet. |
| asset_led | wI=2 | You know which systems matter most and how an attacker would reach them. | Only works with an asset inventory, which most teams lack. |
| telemetry_led | k=2 | A new program that needs early wins from the data already in the SIEM. | Favors what your logs already show, like searching under the streetlight, and can leave the biggest threats uncovered. |
A rule required by a regulation or an audit carries a mandate (framework, requirement, due date) instead of a preset. A rule required by a regulation or an audit carries a mandate with the framework, the requirement number, and a due date. If the due date is within 90 days, it goes to the front of the queue, ordered by date. Everything else is ordered by score, highest first; ties go to the rule with the lower run cost. Mandated rules come with budget and deadlines, and often catch auditors better than attackers.
5.4 Evidence#
Every one of the six inputs comes with one line saying where the number came from: an incident id, a report section, a query, a ticket. CI rejects a record missing any of them.
5.5 A worked example#
DET-0001, Kerberoasting (T1558.003), scores 4, 4, 4, 4, 2, 2 on the balanced preset: value 12, cost 4, scaled by 4/5, score 2.40. DET-0002, a scheduled task created by a non-admin user, scores 3, 2, 3, 3, 2, 4: value 8, cost 6, scaled by 3/5, score 0.80. The gap comes from run cost and readiness. Under threat_led the two score 3.20 and 1.10; under telemetry_led, 1.92 and 0.48. The order holds in all three.
5.6 The floor, and when a rule has to go#
A rule's floor is the typical minutes to triage one of its alerts divided by the most analyst minutes the program will spend per true positive (120 by default). A rule that takes 30 minutes to triage must be right at least 25% of the time; one that takes 6 minutes, 5%.
Retire on any one trigger: its true-positive share stayed below its floor for two 30-day periods in a row; it fired at least once in 180 days and was never right; the log source it needs has been missing for 30 days straight, so its readiness fell to 0; the technique or the system it protects is gone, for example because the platform was decommissioned. It has not fired at all in 365 days. Either the data stopped or the hypothesis was wrong; review it before retiring it.