Threat intelligence is the discipline most security programs spend the most money on and the discipline they extract the least decisions from. A field guide to fixing it.

The mature SOC is not the one with the most detections. It is the one whose detections each have an owner, a documented intent, and a quarterly tuning review.