Reference library

Detection course

An outline for writing detections that hold up. Six modules, from foundations through purple team exercises. Module 5 is use case development, including AI-system cases mapped to MITRE ATLAS. The lessons that have a write-up are linked. The rest are titles and durations only.

6 modules · 31 lessons

Module 01

Foundations

Understand the fundamentals of detection engineering and how AI is transforming the field.

1.1What is Detection Engineering?Learn the role of detection engineers and why this discipline is critical for modern security operations.10 min
1.2The Detection LifecycleFrom threat intelligence to production rules: understand the end-to-end process of creating detections.15 min
1.3Introduction to SIGMALearn the SIGMA rule format - the universal language for detection rules that works across any SIEM.20 min
1.4How AI is Transforming Detection EngineeringDiscover how LLMs and AI tools can 10x your detection capabilities and what the future holds.15 min

Module 02

Understanding ATT&CK

Master the MITRE ATT&CK framework for understanding adversary behaviors and mapping your detections.

Module 03

Understanding D3FEND

Master the MITRE D3FEND framework for mapping defensive countermeasures to adversary techniques.

Module 04

AI-Assisted Detection Writing

Learn to leverage AI tools to write detection rules faster and more effectively.

Module 05

Use Case Development

Organize detection capabilities from a business objective to a threat to an implementation, including AI systems mapped to MITRE ATLAS.

Module 06

Purple Team Operations

Combine red and blue team knowledge for comprehensive security testing and continuous improvement.

Use case development