Course Outline
Foundations of Detection Engineering
- Core principles and professional responsibilities
- The detection engineering lifecycle
- Essential tools and telemetry origins
Understanding Log Sources
- Endpoint logs and event artifacts
- Network traffic and flow data
- Cloud and identity provider logs
Threat Intelligence for Detection
- Categories of threat intelligence
- Utilizing TI to guide detection design
- Correlating threats with specific log sources
Building Effective Detection Rules
- Rule logic and structural patterns
- Distinguishing between behavioral and signature-based activity
- Implementing Sigma, Elastic, and SO rules
Alert Tuning and Optimization
- Reducing the volume of false positives
- Iterative refinement of rules
- Comprehending alert context and threshold settings
Investigation Techniques
- Validating detection outputs
- Pivoting across various data sources
- Documenting findings and investigation notes
Operationalizing Detections
- Version control and change management
- Deploying rules to production environments
- Monitoring rule performance over time
Advanced Concepts for Junior Engineers
- Alignment with MITRE ATT&CK
- Data normalization and parsing techniques
- Exploring automation opportunities in detection workflows
Summary and Next Steps
Requirements
- A solid grasp of basic networking concepts
- Hands-on experience with operating systems such as Windows or Linux
- A working knowledge of fundamental cybersecurity terminology
Target Audience
- Junior analysts with an interest in security monitoring
- Newly appointed SOC team members
- IT professionals transitioning into detection engineering
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 3900 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.