Course
Detection Engineering
Build detections that fire on attackers, not noise: the telemetry that matters, Sigma-style rule craft, ATT&CK mapping that stays honest, false-positive tuning, atomic tests, and real coverage metrics.
Telemetry: You Cannot Detect What You Do Not Collect
Before you write a single rule, get the data. Process creation, command lines, Sysmon, and a pipeline you can actually query.
- 01Choosing Telemetry That Sees AttackersAV alerts and firewall logs will not catch a living-off-the-land intruder. Here is the telemetry that actually does.20mOpen
- 02Command Lines and Process Trees: Where the Truth LivesModern malware runs signed Microsoft binaries. The maliciousness lives in the arguments and the parent process.25mOpen
- 03A Log Pipeline You Can Actually QueryWEF, forwarders, and field normalization — getting Sysmon from fifty endpoints into one searchable place.30mMembers
Rule Craft: Detections That Survive Contact
Sigma anatomy, behavior-based logic that outlives IoCs, and MITRE ATT&CK mapping that does not inflate your coverage.
- 01Anatomy of a Sigma RuleThe vendor-neutral detection format: logsource, selections, conditions, modifiers, and converting to your SIEM.30mMembers
- 02Detect Behavior, Not StringsIoCs rot in days; parent-child relationships and abuse patterns last years. Write rules on what attackers must do.25mMembers
- 03Mapping to MITRE ATT&CK Without LyingTechnique vs sub-technique, tagging what you actually detect, and why a rule is not coverage.20mMembers
Prove It: Testing, Tuning, and Honest Coverage
Tame false positives without gutting the signal, fire atomic tests to prove rules work, and measure coverage you can defend.
- 01Tuning False Positives Without Deleting the SignalBaselining, surgical filters, and the exclusion-list trap — how to quiet a rule while keeping the malicious case.30mPremium
- 02Atomic Tests: Prove Your Detection FiresAn untested rule is a hypothesis. Atomic Red Team, the fix loop, and negative testing.25mPremium
- 03Measuring Coverage Without Fooling YourselfTelemetry, rule, and validated layers; alert fidelity and MTTD; and why '80% ATT&CK coverage' is usually a lie.25mPremium