Detection engineering
The practice of designing, testing, and improving logic that identifies suspicious activity.
Concept Neighborhood
Explore this concept’s connections in the groups below.
Start here
Detection Engineer
A related concept to explore, covered by 9 lessons.
Detection EngineerStart here
9
lessons
Sysmon
8
lessons
Cloud Audit Log
7
lessons
DE-Hunting Interface
7
lessons
DE-SOC Interface
7
lessons
Rule Logic Design
7
lessons
Show 32 more connections
Tactical Intelligence
7
lessons
Threat Hunting
7
lessons
Threat to Detection
7
lessons
Blue Team
6
lessons
Detection and Analysis
6
lessons
Playbook Development
6
lessons
Proactive vs Reactive
6
lessons
Security Engineering
6
lessons
Query Tuning
5
lessons
SIEM
5
lessons
SIEM Data Models
5
lessons
Adversary Emulation
4
lessons
Data Lakes
3
lessons
Indexes
3
lessons
IOC Operationalization
3
lessons
Regression Testing
3
lessons
Serverless Detection
2
lessons
Threat Hunters
2
lessons
Atomic Red Team
1
lesson
Continuous Improvement
1
lesson
Coverage Metrics
1
lesson
DE Skills
1
lesson
DE-Adjacent Roles
1
lesson
Detection Community
1
lesson
Functional Exercises
1
lesson
Purple Team Exercises
1
lesson
Response Automation
1
lesson
Sigma Rules
1
lesson
SOC-Engineering Interface
1
lesson
Telemetry Gaps
1
lesson
TI to Adjacent Roles
1
lesson
Tool Integration
1
lesson
Related Lessons
16 lessons cover this conceptBuilding Detections from Threat to Rule
SOC Analyst
Testing and Validating Detections
SOC Analyst
Detection Tuning Without Weakening Coverage
SOC Analyst
Detection Coverage Analysis
SOC Analyst
Common Detection Patterns
SOC Analyst
Career Path and Growth as a Detection Engineer
SOC Analyst
Design a Sustainable SOC Operating Model
General Beginner
Understand the Blue Team Mission
General Beginner
Show 8 more lessonsShow fewer lessons
Follow the Current Incident-Response Model
General Beginner
Measure Operations Without Gaming Them
General Beginner
Exercise the Response Capability Safely
General Beginner
Learn with Safety and Accountability
General Beginner
Design Security Telemetry
General Beginner
Build Reliable Source Coverage
General Beginner
Protect the Telemetry Pipeline
General Beginner
Detection Engineering Purpose and Workflow
SOC Analyst
Sign in to open lesson content directly.