Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Duration 21 hours
Course Outline
Foundational Principles of Detection Engineering
- Core responsibilities and operational concepts
- The detection engineering lifecycle
- Primary tools and telemetry origins
Log Source Analysis
- Endpoint records and event artifacts
- Network traffic and flow metrics
- Cloud infrastructure and identity provider logs
Integrating Threat Intelligence
- Categories of threat intelligence data
- Leveraging intelligence to guide detection strategy
- Aligning threats with applicable log sources
Constructing Robust Detection Rules
- Rule logic and pattern architectures
- Distinguishing behavioral from signature-based activity
- Utilizing Sigma, Elastic, and Security Onion (SO) rules
Alert Calibration and Performance Optimization
- Reducing false positive rates
- Continuous rule refinement processes
- Evaluating alert context and threshold settings
Investigation Methodologies
- Verifying detection validity
- Cross-referencing data across multiple sources
- Documenting results and investigative notes
Implementing Detection Controls
- Version control and change management practices
- Deploying rules to production environments
- Monitoring long-term rule efficacy
Advanced Concepts for Entry-Level Practitioners
- Alignment with MITRE ATT&CK frameworks
- Data standardization and parsing techniques
- Automation potential in detection workflows for government applications
Conclusions and Future Directions
Requirements
- Basic understanding of networking principles
- Experience utilizing operating systems such as Windows or Linux
- Familiarity with fundamental cybersecurity terminology
Intended Audience
- Junior analysts with an interest in security monitoring
- New members of Security Operations Center (SOC) teams
- Information technology professionals transitioning into detection engineering roles for government contexts
Testimonials (2)
Clarity and pace of explanations
Federica Galeazzi - Aethra Telecomunications SRL
Course - AI-Powered Cybersecurity: Advanced Threat Detection & Response
It did give me the insight what I needed :) I am starting teaching on a BTEC Level 3 qualification and wanted to widen my knowledge in this area.