🎯 What You'll Learn
- Map detections to attacker behaviour
- Engineer durable, high-fidelity detections
- Test detections against real techniques
- Maintain detections as code
About This Workbook
Detection engineering treats detections as a product. This workbook covers the discipline: mapping attacker behaviour, building robust analytics, and testing and maintaining them over time.
Chapter 1 — The Discipline
Treating detection as engineering, not guesswork.
- Behaviour-based detection
- Frameworks and mapping
- Detection lifecycle
Chapter 2 — Building Detections
Crafting analytics that hold up in production.
- Data requirements
- Robust logic
- Avoiding brittleness
Chapter 3 — Testing & Maintenance
Keeping detections honest over time.
- Validation
- Detection as code
- Tuning
Keep going. Work through each chapter in order, then apply what you learned in the matching labs.