Get in Touch
 Duration 21 hours

Course Outline

Foundations of Detection Engineering

  • Core concepts and key responsibilities
  • The lifecycle of detection engineering
  • Essential tools and telemetry sources

Understanding Log Sources

  • Endpoint logs and event artifacts
  • Network traffic and flow data
  • Cloud and identity provider logs

Threat Intelligence for Detection

  • Categorizations of threat intelligence
  • Utilizing TI to guide detection design
  • Mapping threats to appropriate log sources

Crafting Effective Detection Rules

  • Rule logic and pattern structures
  • Distinguishing between behavioral and signature-based detection
  • Implementing Sigma, Elastic, and SO rules

Alert Tuning and Optimization

  • Strategies to reduce false positives
  • Iterative refinement of rules
  • Understanding alert context and thresholds

Investigation Techniques

  • Validating detection triggers
  • Pivoting across multiple data sources
  • Documenting findings and investigation notes

Operationalizing Detections

  • Version control and change management
  • Deploying rules to production systems
  • Tracking rule performance over time

Advanced Concepts for Junior Engineers

  • Alignment with MITRE ATT&CK
  • Data normalization and parsing
  • Automation opportunities in detection workflows

Summary and Next Steps

Requirements

  • Foundational knowledge of basic networking concepts
  • Practical experience with operating systems such as Windows or Linux
  • Basic familiarity with core cybersecurity terminology

Target Audience

  • Entry-level analysts interested in security monitoring
  • Newly joined SOC team members
  • IT specialists transitioning into detection engineering roles

Number of participants


Price per participant

Testimonials (2)

Upcoming Courses

Related Categories