This course is coming soon. It is not yet open for enrollment, and no payment is taken.
The outline and outcomes below reflect what this course will cover. Check back soon.
Coming soonIntermediate
Detection Engineering with Sigma
Write durable, portable detections and measure their coverage.
By LearnDefend Security Team · Detection Engineering
About this course
Go beyond alerts to engineering: express detections structurally, key on durable behaviour over volatile artifacts, map to ATT&CK, and tune out false positives with discipline rather than blunt thresholds.
What you'll learn
- Design behavioural detections that survive hash and IP rotation.
- Express rules in a tool-neutral, Sigma-style structure.
- Map coverage to ATT&CK and find the gaps.
- Tune noisy rules without going blind to real attacks.
Course outline
- 1Durable fields vs volatile artifacts
- 2Boolean structure for precision
- 3ATT&CK mapping and coverage
- 4Tuning and the false-positive budget
Prerequisites
- Log analysis fundamentals and comfort reading process telemetry.