Detection opportunity

A detection opportunity is a content work item that Perpetual opens when threat report triage finds a behavior that needs a new detection.

Perpetual evaluates the report against one Space's datasets and existing detections. It opens an opportunity when its confidence that the behavior needs a new detection is at least 0.7. The opportunity links the report to the changeset containing the proposed detection.

A detection opportunity uses the content work item routes, fields, and statuses. Its linked threat report distinguishes it from a work item you create. In the web app, the Space overview lists these work items under "Detection Opportunities".

Related

• Content work item, including its fields and statuses.
• Threat report, the intelligence that produces an opportunity.
• Developing detections, how Perpetual turns threat intelligence into detection work.