Framework Core
Framework Core
The Framework Core is a suite of activities aimed at achieving specific cybersecurity objectives, supplemented by illustrative examples to guide their implementation. The Core is structured around three lifecycle phases: Sunrise, Midday, and Sunset which holistically cover the detection lifecycle from inception to completion, with dedicated functions, guidelines, and goals for each phase. Together, these components provide detection engineers with a “north star” focus, enabling them to deliver high-quality detections with precision.
Functions, Goals, Guidelines
Each phase of the detection lifecycle is defined by specific functions, goals, and guidelines. These elements work together to guide detection engineers in producing robust, reliable detections
Functions
Inspired by the single-responsibility principle from software engineering, each function in ODEF represents a discrete step with a singular focus and outcome within the detection lifecycle. These single-goal activities are designed to drive a specific activity, ensuring clarity and precision at every stage.
Goals
Each function is crafted to achieve a specific, well-defined result that aligns with the overarching objectives of the detection lifecycle. While goals may sometimes be high-level or abstract, it is strongly recommended to maintain a direct correlation between functions and goals. This alignment ensures that each function contributes meaningfully toward the end goal, enhancing both focus and quality in detection engineering.
Guideline
Guidelines act as reference materials that support the achievement of goals within each function. They provide detection engineers with context-specific insights and best practices, helping to standardize processes while allowing adaptability. For example, a document detailing a company’s unique Change Management process would serve as a valuable guideline
Phases in detail
The Core encompasses three primary lifecycle phases:
These phases collectively chronicle the lifespan of a detection mechanism, from its conception to its eventual retirement/decommissioning.