6. Detection engineering

Concepts

• indicators
• signatures
• behavioral detection
• correlation
• thresholds
• baselines
• anomaly detection
• false positives
• false negatives
• detection logic

Example:

10 failed logins
       ↓
same account
       ↓
same source IP
       ↓
within 2 minutes
       ↓
possible brute force

Then teach:

How do we turn this observation into a detection rule?

Learn:

• Sigma
• YARA basics
• SIEM detection rules
• MITRE ATT&CK mapping