OpenTide Detection Objective (DOM)

A DOM bridges the gap between threat modelling (TVM) and deployable detection rules (MDR). It answers: "What signals would tell us this threat is happening, and what data do we need to detect them?"

Preconditions

1. Load Schemas/Templates for DOM (e.g. dom::1.0 — always check the live template for the current version) and authoritative JSON schemas.
2. Identify related TVM UUIDs. Update rather than duplicate when coverage shifts.
3. Review existing DOMs in the corpus to avoid overlapping coverage.

Complete field reference

Top-level