Threat detection
Threat detection is the identification of activity or conditions that may indicate a security threat, attack, or compromise.
Data-Driven Cybersecurity
Advanced threat detection is the proactive identification and mitigation of potential cybersecurity threats using monitoring, anomaly detection, predictive analytics, or AI-driven models.
- How it is used
- Uses early identification of suspicious activity to guide incident response and justify security investment through measurable risk reduction.
- How deep it goes
- Develops a monitoring-to-response workflow and detection metrics, while explaining machine-learning classifiers conceptually rather than deriving their internals.
- Examples
- Compares a healthcare detection investment with response times and estimated savings, and uses a dashboard of false positives and detection rates.
- What you can do after
- Operate/configure a continuous monitoring program and evaluate/understand its alerts, response times, and detection accuracy.
Read how Data-Driven Cybersecurity explains threat detection →
Azure Security
Threat detection is the process of identifying activity or conditions that may represent a security threat or attack, including during container workload execution.
- How it is used
- Monitors running Kubernetes workloads and infrastructure for suspicious activity that may indicate an attack.
- How deep it goes
- Explains control-plane logs, node agents, alert generation, investigation, and response, while deferring deeper service coverage.
- Examples
- Uses crypto-mining, fileless attacks, malicious container images, and processes started inside production containers.
- What you can do after
- Diagnose suspicious container activity through Defender for Cloud alerts and investigate incidents further with Microsoft Sentinel.
Related concepts
- threat huntingcontrasts with · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
- scheduled query ruleused by · A scheduled query rule is a detection rule that periodically runs a query and generates security alerts or incidents when its results meet defined criteria.
- Microsoft Defender for Containerspart of · Microsoft Defender for Containers is Microsoft's cloud security service for detecting threats, assessing vulnerabilities, and enforcing security policies across containerized workloads and Kubernetes environments.
- artificial intelligenceused by · Artificial intelligence is the field concerned with creating computational systems that perform tasks associated with human intelligence, such as learning, reasoning, perception, or decision-making.
- security information and event managementused by · Security information and event management is a class of security systems that centrally collects, correlates, and analyzes security events and log data to support monitoring and response.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.