What is Threat detection? Definition and explanations
Threat detection covers the means of identifying malicious activity in progress, based on known signatures, deviations from usual behaviour, or correlation rules. Its quality is judged on two opposing quantities: what it misses and the noise it generates. Detection that alerts too often ends up ignored, which amounts to not detecting at all.
In one sentence
Threat detection identifies malicious activity in progress, by signature or behavioural deviation.