First Journal Review and Q1 Direction
A short look back at the first build cycle, and why connecting intelligence to action became the next priority.
Progress
By the end of this first run, I had ThreatWatch collecting, deduplicating, and ranking reporting from several source types. The unresolved problem was analysis quality: stronger evidence, freshness, and confidence handling.
The detection coverage project had a defined model for campaigns, ATT&CK techniques, rules, telemetry, and D3FEND controls. Early work showed that practical gaps cluster around stages where common telemetry is weak.
Next direction
The priority for the next quarter was to connect both systems. ThreatWatch would provide current, evidence-backed campaign context. The coverage model would use that context to identify defensive gaps and useful next actions.
That connection later became central to RedBlue.