Get in Touch
 Duration 21 hours

Course Outline

Basics of Detection Engineering

  • Key principles and job duties
  • The detection engineering cycle
  • Essential tools and telemetry origins

Recognizing Log Sources

  • Endpoint logs and event records
  • Network traffic and flow information
  • Cloud and identity provider logs

Threat Intelligence in Detection

  • Categories of threat intelligence
  • Applying TI to guide detection design
  • Linking threats to corresponding log sources

Creating High-Impact Detection Rules

  • Rule logic and pattern formations
  • Identifying behavioral versus signature-based actions
  • Utilizing Sigma, Elastic, and SO rules

Alert Refinement and Optimization

  • Reducing false positives
  • Progressive rule improvement
  • Comprehending alert context and thresholds

Investigation Methods

  • Verifying detections
  • Pivoting among various data sources
  • Recording insights and investigation details

Implementing Detections Operationally

  • Version control and change management
  • Rolling out rules to live environments
  • Tracking rule effectiveness over time

Advanced Ideas for Entry-Level Engineers

  • Alignment with MITRE ATT&CK
  • Data standardization and parsing
  • Automation potential in detection processes

Recap and Future Steps

Requirements

  • A grasp of fundamental networking principles
  • Proficiency in operating systems like Windows or Linux
  • Awareness of basic cybersecurity vocabulary

Target Audience

  • Junior analysts focused on security monitoring
  • Recent hires on SOC teams
  • IT specialists transitioning into detection engineering

Number of participants


Price per participant

Testimonials (2)

Upcoming Courses

Related Categories