Free through lesson 3

Detection Engineering

Read the shape of attacks with ATT&CK, write rules in Sigma and YARA, then correlate, test, tune false positives and triage. In 30 lessons you learn to build and maintain rules that find signs of attack in logs.

Start from lesson 1 Unlock every course

Curriculum

The 30 lessons are grouped into six chapters. Working through from chapter 1 is recommended, but you can also dip into the parts you need. * Standard-library Python runs right in the browser. All commands and logs come from fictional hosts.

Chapter 1 — How detection works (lessons 1–5)

The kinds of detection and where in an attack the clues appear. You learn to weigh false positives against misses and decide what to detect first.

What Detection Is: How It Differs from Prevention, and Three Approaches

Detection finds what got past prevention. The three approaches, signature, behaviour and anomaly, and what each is good and bad at.

Free

The Flow of an Attack and Where Detection Can Happen

An attack is not a single moment but a sequence of stages. Read the kill chain and ATT&CK tactics as a map of where logs are left behind.

Free

How to Read MITRE ATT&CK

How tactics, techniques and sub-techniques relate, and how to read their IDs. Using the detection strategy entries, and why ATT&CK is not a checklist.

Free

False Positives and Misses: Precision and Recall

Split alert outcomes into four, and measure them with precision and recall. Weigh false positives against misses, and see the threshold trade-off.

Deciding What to Detect First

You cannot detect everything. Start from a threat model and your most valuable assets, and build cheap, high-value detections first.

Chapter 2 — Writing rules (lessons 6–10)

Writing threshold, Sigma and correlation rules, and handling exceptions safely.

Your First Rule: A Spike in Failed Logins

Catch "many failures in a short time" with a threshold and a time window. Count with a sliding window and see how the grouping key changes what you find.

Writing a Sigma Rule

Sigma, a vendor-neutral format for detection rules. Read the logsource, detection and condition skeleton plus metadata, and see how rules are converted for use.

Building Conditions: and, or, not and Modifiers

How to combine selections, when to use which field modifier, and how to write exclusions. See for yourself why over-broad wildcards are dangerous.

Correlation Rules: Catching a Sequence of Events

Events that are weak on their own become a strong signal when they line up for one user in a short time. Write a correlation in Python and read Sigma's correlation format.

Handling Exceptions (Allowlists)

Exceptions that silence false positives should be narrow, time-limited and documented. A way to find expired exceptions, and the risk of exceptions being abused.

Chapter 3 — Host detection (lessons 11–15)

Catching suspicious behaviour on hosts using process data, persistence artefacts, Linux audit logs and YARA.

Reading Process Creation Events

Find anomalies in the parent-child relationships and command lines of process creation logs. Turn signs such as an Office app launching a shell or long, encoded arguments into detection rules.

Spotting Signs of Persistence

Catch the creation of mechanisms that survive a reboot (services, scheduled tasks, Run keys, cron, systemd) in logs. Find new entries by diffing against a baseline.

Signs of Suspicious Access to Credentials

Use defender telemetry to catch access to where credentials live: LSASS, registry hives and saved browser passwords. Also covers protective settings and how to handle exceptions.

Detection on Linux Hosts (auditd)

Use auditd rules to catch changes to sudoers, newly created SUID files and unexpected listening ports. Learn how to pull events with ausearch and how to diff against a baseline.

YARA Basics

Learn the structure of YARA rules, which match file contents with strings and conditions. Write a rule against harmless test strings and check the matching logic in Python.

Chapter 4 — Network and cloud detection (lessons 16–20)

Building rules for beaconing, DNS, web, cloud and identity-provider signals.

Finding Beaconing Traffic

Find traffic that keeps connecting out at regular intervals by measuring how regular the gaps between connections are. Covers coping with jitter and telling it apart from legitimate periodic traffic.

Spotting DNS Anomalies

Find long, random-looking subdomains and rare domains that are almost never looked up internally from DNS logs. Score them by entropy and length.

Signs of Attacks on Web Applications

Read scanning, error spikes and signs of successful attacks from access logs and WAF logs. Look at each source's 404 ratio and how the app responded to requests the WAF flagged.

Detection in the Cloud

Find use of root or global admin accounts, disabled logging, new access keys and activity in unusual regions from cloud management logs. Uses AWS CloudTrail as the example.

Detection in Identity Platforms

Find impossible travel, MFA fatigue and signs of risky sign-ins in sign-in logs. Calculate the speed of impossible travel using fictional coordinates.

Chapter 5 — Testing and operations (lessons 21–25)

Testing rules, managing them as code, measuring coverage and improving them over time.

Testing detection rules

Checking rules against positive and negative sample events, testing the boundaries, and replaying past logs.

Managing detections as code

Keeping rules as files in a repository and deploying them through review and CI, with history and rollback.

Validating detections with a purple team

Reproducing attacker behaviour in an authorised lab and checking together that logs and alerts appear as expected. Planning, recording and re-testing.

Measuring coverage

Grading each ATT&CK technique by data, rule and test, finding data source gaps, and using the numbers without being ruled by them.

The rule improvement cycle

Collecting triage results per rule and tuning, checking rules that never fire, and deciding when to retire a rule.

Chapter 6 — From alert to triage (lessons 26–30)

Adding context to alerts, prioritising them and feeding triage. The course ends with a small detection pack.

Adding context to alerts

Automatically attaching asset owner and criticality, user role and external information to alerts, and the traps of too much or stale data.

Scoring and priority

Instead of paging on each weak signal, add up points per user or host to set priority. How to choose the points, and the pitfalls.

The triage procedure

The first questions to answer for an alert, true positive versus benign positive versus false positive, escalation criteria and how to record it.

Using threat intelligence

IOCs versus TTPs, the freshness and false positive risk of IOCs, and turning TTPs from reports into detection rules via ATT&CK.

Wrap-up: building a small detection pack

Choosing six rules to protect a fictional members-only web service, with a test table and operating rules. A bridge to the Incident Response course.

Once you have finished all 30 lessons, move on to the Incident Response course. See the order of courses on the security track page. Membership unlocks every course.