Updated to reflect new ordering

Author: johnwunder

trainings/detection-training/Data Sources.ipynb

@@ -270,6 +270,17 @@
     "    \n",
     "FileLink('data_sources.json')"
    ]
+  },
+  {
+   "cell_type": "markdown",
+   "metadata": {},
+   "source": [
+    "# Overlaying Priorities with Data Sources\n",
+    "\n",
+    "The reason we collect data is of course to help us detect attacks, so let's see how the data that we've collected measures up.\n",
+    "\n",
+    "How would you do this?"
+   ]
   }
  ],
  "metadata": {

trainings/detection-training/Prioritization Scenarios.ipynb

@@ -41,7 +41,7 @@
     "* Powershell: https://attack.mitre.org/techniques/T1086/ \n",
     "* NTFS File Attributes: https://attack.mitre.org/techniques/T1096/\n",
     "* File Permissions Modification: https://attack.mitre.org/techniques/T1222/  \n",
-    "* Indicator Blocking: https://attack.mitre.org/techniques/T1054/\n",
+    "* Indicator Removal from Host: https://attack.mitre.org/techniques/T1070/\n",
     "\n",
     "*Consider: What extra threat information, in addition to the techniques, would be helpful at building detections?*"
    ]
@@ -57,22 +57,6 @@
     "1. Making sure to have the APT1/APT3 layer in the navigator and the new custom layer in the navigator, hit the plus to create a new layer.\n",
     "2. Adjust the formula and scoring so that you get prioritized detections. How would you weight these different sets of intelligence? What are your top techniques?"
    ]
-  },
-  {
-   "cell_type": "markdown",
-   "metadata": {},
-   "source": [
-    "# Formulate our detection strategy\n",
-    "\n",
-    "Let's assume we want to detect the techniques used in the recent Blue Panda campaign. How would we see which techniques we could cover given our data sources?\n",
-    "\n",
-    "1. Keeping your prioritization heatmap in the navigator, open up your data sources layer.\n",
-    "2. Create a new layer that shows you, of your prioritized techniques:\n",
-    "  * Which can be detected given current data collection\n",
-    "  * Where you have gaps.\n",
-    "\n",
-    "*Consider: What data sources might you want to add to increase coverage?*"
-   ]
   }
  ],
  "metadata": {