Get in Touch
 Duration 21 hours

Course Outline

Foundations of Detection Engineering

  • Core principles and professional responsibilities
  • The detection engineering lifecycle
  • Essential tools and telemetry origins

Understanding Log Sources

  • Endpoint logs and event artifacts
  • Network traffic and flow data
  • Cloud and identity provider logs

Threat Intelligence for Detection

  • Categories of threat intelligence
  • Utilizing TI to guide detection design
  • Correlating threats with specific log sources

Building Effective Detection Rules

  • Rule logic and structural patterns
  • Distinguishing between behavioral and signature-based activity
  • Implementing Sigma, Elastic, and SO rules

Alert Tuning and Optimization

  • Reducing the volume of false positives
  • Iterative refinement of rules
  • Comprehending alert context and threshold settings

Investigation Techniques

  • Validating detection outputs
  • Pivoting across various data sources
  • Documenting findings and investigation notes

Operationalizing Detections

  • Version control and change management
  • Deploying rules to production environments
  • Monitoring rule performance over time

Advanced Concepts for Junior Engineers

  • Alignment with MITRE ATT&CK
  • Data normalization and parsing techniques
  • Exploring automation opportunities in detection workflows

Summary and Next Steps

Requirements

  • A solid grasp of basic networking concepts
  • Hands-on experience with operating systems such as Windows or Linux
  • A working knowledge of fundamental cybersecurity terminology

Target Audience

  • Junior analysts with an interest in security monitoring
  • Newly appointed SOC team members
  • IT professionals transitioning into detection engineering

Custom Corporate Training

Training solutions designed exclusively for businesses.

  • Customized Content: We adapt the syllabus and practical exercises to the real goals and needs of your project.
  • Flexible Schedule: Dates and times adapted to your team's agenda.
  • Format: Online (live), In-company (at your offices), or Hybrid.
Investment

Price per private group, online live training, starting from 3900 € + VAT*

Contact us for an exact quote and to hear our latest promotions

Testimonials (2)

Provisional Upcoming Courses (Contact Us For More Information)

Related Categories