Get in Touch
 Duration 21 hours

Course Outline

Basics of Detection Engineering

  • Essential concepts and roles
  • The detection engineering lifecycle
  • Primary tools and telemetry origins

Exploring Log Sources

  • Endpoint logs and event artifacts
  • Network traffic and flow information
  • Logs from cloud and identity providers

Applying Threat Intelligence to Detections

  • Categories of threat intelligence
  • Integrating TI into detection design
  • Correlating threats with specific log sources

Creating Robust Detection Rules

  • Rule logic and pattern frameworks
  • Identifying behavioral versus signature-based activity
  • Utilizing Sigma, Elastic, and SO rules

Tuning and Optimizing Alerts

  • Reducing false positives
  • Iterative rule improvement
  • Comprehending alert context and thresholds

Investigation Methods

  • Verifying detections
  • Tracing across multiple data sources
  • Recording findings and investigation details

Implementing Detections Operationally

  • Version control and change management
  • Releasing rules to production environments
  • Tracking rule performance over time

Advanced Topics for Junior Engineers

  • Alignment with MITRE ATT&CK
  • Data normalization and parsing
  • Automating detection workflows

Recap and Future Steps

Requirements

  • Knowledge of fundamental networking concepts
  • Hands-on experience with operating systems like Windows or Linux
  • Basic understanding of core cybersecurity terminology

Target Audience

  • Junior analysts focused on security monitoring
  • New members of SOC teams
  • IT specialists transitioning into detection engineering

Number of participants


Price per participant

Testimonials (2)

Upcoming Courses

Related Categories