Detection Engineering

What you will be able to do

• You will be able to write portable Sigma rules from scratch, including logsources, conditions, and field mappings, and convert them to run on your own Security Information and Event Management (SIEM) platform.
• You will be able to turn a threat hypothesis into a behavioral analytic rule that detects attacker techniques rather than easily changed indicators.
• You will be able to tune noisy detections with allowlists, thresholds, and baselining so your alerts stay trustworthy.
• You will be able to manage detection content as code in version control and test it in a continuous integration pipeline before it ships.
• You will be able to run safe adversary emulation, using atomic tests and purple teaming, to confirm that your detections actually fire.
• You will be able to map your detection coverage to MITRE ATT&CK and build a coverage heatmap that shows exactly where the gaps are.
• You will be able to measure detection quality with clear metrics and prioritize which gaps to close first.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   Foundations of Detection Engineering

   Before you write a single rule, you need to know what makes a detection worth building and what makes one fail. This module introduces the detection lifecycle, the detection-as-code mindset that treats every rule like software, and the log telemetry that good detections depend on. You will also learn the difference between chasing indicators and detecting behavior, so the rules you write later actually survive contact with a real attacker.

   2 lessons · 5 quiz questions

2. 02

   Writing Sigma and Analytic Rules

   This is where you start building. You will author Sigma rules by hand, learn how logsources, conditions, and fields fit together, and convert them to run on real platforms. You will also turn a threat hypothesis into a behavioral analytic rule that catches an attacker technique instead of a brittle indicator that changes overnight.

   2 lessons · 5 quiz questions · assignment

3. 03

   Tuning and Testing Detections

   A rule that fires on everything is worse than no rule at all, because it trains analysts to ignore it. This module shows you how to cut false positives with allowlists, thresholds, and baselining while protecting your true detections, then how to manage detection content as code in version control and validate every rule in a continuous integration pipeline before it reaches production.

   2 lessons · 5 quiz questions

4. 04

   Validating Coverage with Adversary Emulation and MITRE ATT&CK

   The last step in detection engineering is proof. In this module you will run safe adversary emulation with atomic tests and purple teaming to confirm your detections fire against real attacker behavior, then map that coverage to MITRE ATT&CK, build an honest heatmap, and measure detection quality so you can show exactly what you can catch and what still needs work.

   2 lessons · 5 quiz questions · assignment