My understanding is that it's actually not all that common for engineers to do quite the same things attackers do, since a lot of intel is fairly specific. Sur

My understanding is that it's actually not all that common for engineers to do quite the same things attackers do, since a lot of intel is fairly specific. Sure, abnormal network or process behavior might cause interest, but if it's not connecting to "superbadmalware.org" or running "known-exploit.exe", a dev probably doesn't cause very many false positives. It probably depends on the company, and the people looking out for that company will know the difference. As for what to do with all that information, it's definitely a great question. Right now I think the answer is person-driven (get eyeballs on the intel), but obviously that's not going to last. Everyone in the space (AFAIK) is trying to take what analysts do, and productize it somehow. I'm sure you've got insight into how that's happening on your end, it's a pretty straightforward leap when faced with, "Do I scale my service?" questions.