Naming an objective Malware as a Collection Source reclassifies a whole discipline into an intelligence input. Nine unweighted objectives, and why coverage beats a mark budget on this paper.
The GCTI Exam Treats Malware as a Source, Not a Skill
MITRE ATT&CK
Splunk SPLK-5002 Detection Engineering Exam Guide
A domain-by-domain guide to the Splunk SPLK-5002 Detection Engineering exam: data normalisation, correlation-search tuning, risk-based alerting, the detection lifecycle, SOAR automation, and metrics.
