You may not think attribution matters, but I think attribution is also on the detection spectrum, or #DETECTRUM. I'm trying to think about it as layers of additive traps that enable us to hedge our bets for visibility, resilience in detection, sometimes to figure out who dun it. 
I think the #DETECTRUM can be used to model both inputs and outputs of the detection engineering process - whether you're plotting "logic designed to find evil," alerts, the tech, or the or the data itself. The graphs might look a bit different, but same ideology might be useful
To clarify, this view of the #detectrum is meant to not to describe how detection is done (iocs, sigs, ips, wutev), but illustrate the _outputs from_ minimal viable detection. Outputs build on each other, higher outputs increasingly distinguish evil found & enable other processes
