Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Foundations of Detection Engineering
- Essential concepts and roles
- The detection engineering lifecycle
- Primary tools and telemetry origins
Exploring Log Sources
- Endpoint logs and event data artifacts
- Network traffic and flow information
- Cloud and identity provider logs
Threat Intelligence for Detection
- Categorizations of threat intelligence
- Leveraging TI to guide detection design
- Aligning threats with specific log sources
Creating Robust Detection Rules
- Rule logic and pattern frameworks
- Identifying behavioral versus signature-based activity
- Utilizing Sigma, Elastic, and SO rules
Alert Tuning and Optimization
- Reducing false positives
- Refining rules through iteration
- Comprehending alert context and thresholds
Investigation Methodologies
- Verifying detections
- Pivoting across various data sources
- Recording findings and investigation details
Operationalizing Detections
- Version control and change management
- Rolling out rules to production environments
- Tracking rule performance over time
Advanced Concepts for Junior Engineers
- Alignment with MITRE ATT&CK
- Data normalization and parsing
- Automation potential in detection workflows
Conclusion and Future Directions
Requirements
- A grasp of fundamental networking principles
- Proficiency with operating systems like Windows or Linux
- Acknowledgement of core cybersecurity terminology
Target Audience
- Junior analysts focused on security monitoring
- Newly onboarded SOC team members
- IT professionals transitioning into detection engineering
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.