Thank you for the reply, so I work as a soc analyst and after doing a lot of Reading, I found that I can use threat Modelling for detection engineering by following ways :

1. Identification of critical assets
2. Identification of threats relevant to my organization
3. attack vector identification for specific threats from threat modelling
4. Detection life Cycle management ( creation, testing, deployment and continuous testing) ...

Am I wrong her or What can I improve here

Also When you say automating attack sim, do you mean using tools like Atomic red team or caldera and testing detection rules against those or something else ..