Browser LabLD-DE-LAB-003Medium
Browser LabLD-DE-LAB-003Medium28 min
Validate the Detection
A Jisr detection for DNS-tunneling exfiltration is ready for review. Before it ships, you must validate it against labeled fixtures — malicious cases it must catch and benign cases it must ignore — and measure whether it is production-ready. Firing on the attack is only half the test.
What you will be able to do
- Validate against both positive and negative fixtures.
- Interpret precision and recall from the results.
- Decide production readiness honestly.
Detection EngineeringLog AnalysisAnalyst ReportingT1071.004 — DNST1048 — Exfiltration Over Alternative Protocol
Sign in to start this lab.
Sign in