Detection Engineering
Turning attacker behavior and telemetry into high-quality, maintainable detections — from requirements and data quality through detection logic, testing, false-positive tuning, coverage and production readiness. Tool-neutral (Sigma-style logic). Recommended prior knowledge: SOC, Threat Hunting or Malware Analysis.
What you will be able to do
- Turn a threat behavior into a testable detection requirement and identify the telemetry it needs.
- Write and tune detection logic that catches behavior without drowning the queue in false positives.
- Validate a detection against malicious and benign fixtures, map coverage, and ready it for production.
Units
- 01
What Detection Engineering Is
The detection lifecycle, detection requirements, threat-informed detection, use cases, and turning a hypothesis into a detection goal.
BeginnerAvailableWhy you are learning this
A detection without a requirement is a guess. This module builds the discipline of deciding WHAT to detect and WHY before writing any logic.
- 02
Telemetry, Fields & Data Quality
Telemetry requirements, parsing and normalization, schema and fields, data quality, and identifying missing telemetry before it breaks a detection.
BeginnerAvailableWhy you are learning this
A detection is only as good as the data under it. This module ensures the fields a rule relies on actually exist, parse correctly, and mean what you think.
- 03
Detection Logic & Rule Design
Boolean logic, thresholds, frequency and time windows, sequence detection, and the choice between IOC, behavioral and TTP-based detections with ATT&CK mapping.
BeginnerAvailableWhy you are learning this
This is where behavior becomes a rule. The module teaches writing logic that expresses the attacker's behavior precisely — neither too broad nor too narrow.
Unit contents7
Theory Lessons(6)
Practical Labs(1)
- 04
Testing, False Positives & Tuning
Positive and negative test cases, ground truth, false positives and negatives, precision and recall, and tuning through exceptions and suppression — not blunt threshold-raising.
Job-ReadyAvailableWhy you are learning this
An untested detection is a liability. This module builds the validation and tuning loop that keeps a rule both effective and quiet enough to trust.
Unit contents8
Theory Lessons(6)
Practical Labs(2)
- 05
Coverage, ATT&CK & Rule Lifecycle
Detection coverage and ATT&CK coverage, gaps, detection drift, rule versioning and documentation, severity and confidence, and response actions.
Job-ReadyAvailableWhy you are learning this
Detections are a portfolio, not a pile. This module teaches measuring coverage honestly, finding gaps, and maintaining rules over their whole life.
- 06
Validation, Handoff & the Thiqa Sprint
Purple-team validation, hunt-to-detection and CTI-to-detection pipelines, the SOC feedback loop, production readiness — and the integrated Thiqa detection sprint.
Job-ReadyAvailableWhy you are learning this
A detection that never reaches production, validated, protected nobody. This module closes the loop from behavior to a production-ready, documented rule — then proves it on a full sprint.
Unit contents7
Recommended next
Endpoint Security
Defending endpoints end to end — architecture and attack surface, telemetry and EDR, process-lineage investigation, containment decisions, and hardening. Where telemetry, detection, forensics and response meet the real host. Recommended prior knowledge: Cyber Foundations, SOC or Detection Engineering.
Threat Hunting
Proactive, hypothesis-driven investigation — finding attacker behavior the alerts missed, and turning what you find into new detections. Recommended prior knowledge: Cyber Foundations or SOC Analyst L1.