Tool Path
Sigma
Write detections as code. Learn Sigma's structure (logsource, detection, selection, condition), express behaviour as portable rules, judge detection quality and false positives, and validate a rule against normalized events — the detection-engineering craft, tool-neutral.
BeginnerDetection EngineeringLog Analysis
Curriculum
- 01Available
Detection-as-Code Foundations
What Sigma answers, YAML basics, and the anatomy of a rule: title, logsource, detection, condition.
- 02Available
Detection Logic
Field/value matching, multiple selections, boolean conditions, filters, and value modifiers (contains, startswith).
- 03Available
Detection Quality
False positives vs false negatives, field mapping, data-source dependencies, tuning, and behaviour vs volatile indicator.
- 04Available
Rule Validation
The loop: behaviour hypothesis → telemetry → rule → test events → matches → tune → document limitations.