Course Outline
Foundations of Detection Engineering
- Key concepts and professional responsibilities
- The end-to-end detection engineering lifecycle
- Essential tools and sources of telemetry
Interpreting Log Sources
- Endpoint logs and relevant event artifacts
- Network traffic patterns and flow data
- Logs from cloud services and identity providers
Leveraging Threat Intelligence for Detection
- Categories of threat intelligence
- Integrating TI into detection design processes
- Correlating threats with specific log sources
Creating Effective Detection Rules
- Rule logic and structural patterns
- Distinguishing between behavioral and signature-based detection
- Utilizing Sigma, Elastic, and SO rule frameworks
Refining and Optimizing Alerts
- Strategies for reducing false positives
- Processes for iterative rule improvement
- Contextual understanding of alerts and threshold settings
Investigative Methodologies
- Verifying detection accuracy
- Pivoting through multiple data sources
- Recording findings and maintaining investigation logs
Implementing Detections in Production
- Version control and change management practices
- Deploying rules to live production systems
- Ongoing monitoring of rule performance
Advanced Concepts for Early-Career Engineers
- Alignment with MITRE ATT&CK
- Data normalization and parsing techniques
- Opportunities for automation in detection workflows
Wrap-up and Path Forward
Requirements
- A solid grasp of fundamental networking principles
- Hands-on experience with operating systems such as Windows or Linux
- Knowledge of core cybersecurity vocabulary
Target Audience
- Junior analysts seeking to expand their security monitoring skills
- Recent additions to SOC teams
- IT specialists transitioning into detection engineering roles
Custom Corporate Training
Training solutions designed exclusively for businesses.
- Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
- Flexible Schedule: Dates and times adapted to your team's agenda.
- Format: Online (live), In-company (at your offices), or Hybrid.
Price per private group, online live training, starting from 3900 € + VAT*
Contact us for an exact quote and to hear our latest promotions
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.
