Skip to content

Detection engineering

Detection engineering as a discipline: detection-as-code with Sigma and testing, log pipelines and SIEM/SOAR, threat hunting and TTP-based detection, cloud DFIR and forensics, and deception plus the alert-quality and metrics work that keeps a program effective. Assumes solid security and cloud fundamentals.

Advanced5 sections · 15 lessons · ~9h total · 60-question self-test

01

Detection-as-code & Sigma

3 lessonsTest yourself

01Detection as codeVersion-controlled, tested, CI/CD-deployed detections.30 min 02Sigma rulesVendor-agnostic detections compiled to any SIEM.30 min 03Testing detectionsTrue-positive/negative tests and Atomic Red Team.30 min

02

Pipelines & SIEM

3 lessonsTest yourself

01Log pipelinesCollect, normalize, enrich; guard the blind spots.30 min 02SIEM & correlationIngest, correlate weak signals, manage cost.30 min 03SOAR & responsePlaybooks that automate first response.30 min

03

Threat hunting

3 lessonsTest yourself

01Hypothesis-driven huntingAssume breach; hunt what alerts miss.30 min 02TTPs & the Pyramid of PainDetect behavior, not disposable indicators.30 min 03Behavioral analytics (UEBA)Baseline normal, flag meaningful deviation.30 min

04

Cloud DFIR & forensics

3 lessonsTest yourself

01Cloud DFIR processOrder of volatility; automate before teardown.35 min 02Evidence acquisitionSnapshots, memory, integrity, chain of custody.35 min 03Timeline analysisReconstruct the intrusion; feed new detections.30 min

05

Deception & alert quality

3 lessonsTest yourself

01Honeytokens & deceptionDecoys nothing legitimate ever touches.25 min 02Alert quality & tuningPrecision over volume; beat alert fatigue.30 min 03Metrics & the loopCoverage, MTTD, precision — measure and improve.25 min

Progress is saved in this browser only — no account required.

Final exam

Test yourself on everything

60 questions drawn from all 5 sections — every answer explained as you pick.

Start final exam