Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Basics of Detection Engineering
- Essential concepts and roles
- The detection engineering lifecycle
- Primary tools and telemetry origins
Exploring Log Sources
- Endpoint logs and event artifacts
- Network traffic and flow information
- Logs from cloud and identity providers
Applying Threat Intelligence to Detections
- Categories of threat intelligence
- Integrating TI into detection design
- Correlating threats with specific log sources
Creating Robust Detection Rules
- Rule logic and pattern frameworks
- Identifying behavioral versus signature-based activity
- Utilizing Sigma, Elastic, and SO rules
Tuning and Optimizing Alerts
- Reducing false positives
- Iterative rule improvement
- Comprehending alert context and thresholds
Investigation Methods
- Verifying detections
- Tracing across multiple data sources
- Recording findings and investigation details
Implementing Detections Operationally
- Version control and change management
- Releasing rules to production environments
- Tracking rule performance over time
Advanced Topics for Junior Engineers
- Alignment with MITRE ATT&CK
- Data normalization and parsing
- Automating detection workflows
Recap and Future Steps
Requirements
- Knowledge of fundamental networking concepts
- Hands-on experience with operating systems like Windows or Linux
- Basic understanding of core cybersecurity terminology
Target Audience
- Junior analysts focused on security monitoring
- New members of SOC teams
- IT specialists transitioning into detection engineering
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.