Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Basics of Detection Engineering
- Key principles and job duties
- The detection engineering cycle
- Essential tools and telemetry origins
Recognizing Log Sources
- Endpoint logs and event records
- Network traffic and flow information
- Cloud and identity provider logs
Threat Intelligence in Detection
- Categories of threat intelligence
- Applying TI to guide detection design
- Linking threats to corresponding log sources
Creating High-Impact Detection Rules
- Rule logic and pattern formations
- Identifying behavioral versus signature-based actions
- Utilizing Sigma, Elastic, and SO rules
Alert Refinement and Optimization
- Reducing false positives
- Progressive rule improvement
- Comprehending alert context and thresholds
Investigation Methods
- Verifying detections
- Pivoting among various data sources
- Recording insights and investigation details
Implementing Detections Operationally
- Version control and change management
- Rolling out rules to live environments
- Tracking rule effectiveness over time
Advanced Ideas for Entry-Level Engineers
- Alignment with MITRE ATT&CK
- Data standardization and parsing
- Automation potential in detection processes
Recap and Future Steps
Requirements
- A grasp of fundamental networking principles
- Proficiency in operating systems like Windows or Linux
- Awareness of basic cybersecurity vocabulary
Target Audience
- Junior analysts focused on security monitoring
- Recent hires on SOC teams
- IT specialists transitioning into detection engineering
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.