Description

This curriculum spans the design and governance of enterprise-scale breach detection systems, comparable in scope to a multi-phase advisory engagement focused on integrating technical controls, organizational policy, and continuous validation across hybrid and cloud environments.

Module 1: Defining Breach Detection Objectives within Enterprise Risk Strategy

Align breach detection thresholds with business-critical assets, ensuring detection coverage prioritizes systems supporting revenue, compliance, and customer data.
Establish acceptable detection latency based on threat actor dwell time benchmarks and regulatory reporting requirements (e.g., 72-hour GDPR notifications).
Decide whether to prioritize detection of known IOCs versus unknown behavioral anomalies, balancing signature-based tools with UEBA investments.
Integrate breach detection goals into the organization’s overall risk appetite statement, requiring formal sign-off from the CISO and risk committee.
Map detection capabilities to MITRE ATT&CK techniques relevant to the organization’s threat model, focusing on prevalent TTPs in the sector.
Define escalation paths for confirmed breaches, specifying roles for SOC, legal, PR, and executive teams in initial response.
Assess whether breach detection ownership resides in security operations, risk management, or a hybrid model, clarifying accountability in org charts.
Negotiate detection scope with business units to avoid blind spots in shadow IT or third-party-hosted applications.

Module 2: Architecting Detection Infrastructure Across Hybrid Environments

Select log sources for ingestion based on forensic value, including endpoint telemetry, firewall flows, cloud API calls, and identity provider events.
Implement log retention policies that balance storage cost with forensic investigation needs, typically 90–365 days for raw logs and longer for summaries.
Deploy lightweight sensors in air-gapped or OT environments where full EDR is not feasible, accepting reduced detection fidelity.
Configure secure log forwarding using TLS and mutual authentication to prevent tampering in transit.
Standardize timestamp synchronization across systems using NTP with authenticated sources to ensure timeline accuracy during investigations.
Design data pipelines to normalize logs from cloud services (AWS CloudTrail, Azure AD) into a common schema for correlation.
Segment detection infrastructure (SIEM, SOAR) from general IT networks to reduce lateral movement risk during a breach.
Evaluate on-premises versus cloud-native SIEM based on data sovereignty laws and existing security tooling investments.

Module 3: Establishing Detection Rules and Alert Logic

Develop custom detection rules for privileged account activity, such as simultaneous logins from disparate geographies or after-hours access to critical databases.
Tune existing SOC rules to suppress false positives from automated IT operations (e.g., patching scripts mimicking ransomware behavior).
Implement threshold-based alerts for brute force attacks, adjusting trigger levels based on user role (e.g., lower thresholds for admin accounts).
Use Sigma rules to maintain detection logic portability across different SIEM platforms during vendor transitions.
Integrate threat intelligence feeds selectively, filtering for IOCs relevant to the organization’s sector and geography.
Define alert severity levels based on potential impact, not just technical indicators (e.g., a phishing alert involving finance staff is higher severity).
Document rule justification and expected detection coverage to support audit and compliance reviews.
Rotate and retire outdated detection rules quarterly to prevent alert fatigue and maintain rulebase efficiency.

Module 4: Integrating Identity and Access Monitoring into Detection Workflows

Correlate failed login attempts across multiple services to detect credential stuffing, especially after known third-party breaches.
Flag use of privileged roles (e.g., Global Admin) from unmanaged or non-corporate devices, even if multi-factor authentication is passed.
Monitor for anomalous service account behavior, such as interactive logins or access from new IP ranges.
Trigger alerts when users access sensitive data stores immediately after role changes or promotions.
Integrate identity governance systems (e.g., SailPoint, Saviynt) to detect privileged access violations in near real time.
Enforce detection of pass-the-hash or Kerberos ticket misuse through endpoint agent telemetry and domain controller logs.
Map user activity to job function baselines to identify deviations, such as developers accessing HR systems.
Validate MFA prompt bombing attempts by detecting rapid, repeated push notifications to a single user.

Module 5: Leveraging Endpoint Detection and Response (EDR) for Breach Confirmation

Configure EDR tools to capture process lineage and network connections for all child processes spawned by user applications.
Define automated containment actions (e.g., isolate host) for high-confidence detections like in-memory code injection or ransomware behavior.
Standardize EDR agent deployment across BYOD and contractor devices, accepting reduced visibility due to privacy constraints.
Use EDR to reconstruct attack timelines during post-incident analysis, relying on local event buffers when central logging fails.
Balance EDR telemetry volume with endpoint performance, disabling non-critical monitoring on legacy systems.
Integrate EDR alerts with ticketing systems using SOAR playbooks to ensure consistent triage and assignment.
Conduct adversarial emulation exercises to validate EDR detection coverage for specific attack scenarios.
Manage EDR console access with role-based controls to prevent insider tampering with detection settings.

Module 6: Orchestrating Detection Across Cloud and SaaS Environments

Enable native logging in cloud platforms (AWS, Azure, GCP) and verify delivery to centralized repositories without gaps.
Detect suspicious SaaS usage, such as bulk data downloads from SharePoint or unauthorized third-party app integrations in O365.
Monitor for creation of new cloud instances in non-production accounts, a common tactic for crypto-mining or C2 infrastructure.
Configure alerts for IAM policy changes that grant excessive permissions, especially in AWS or Azure.
Use CSPM tools to detect misconfigurations (e.g., public S3 buckets) that increase breach likelihood and trigger preemptive alerts.
Integrate cloud workload protection platforms (CWPP) with SIEM to correlate container runtime events with network anomalies.
Address API rate limit challenges when pulling logs from SaaS providers, adjusting polling intervals to avoid service disruption.
Map cloud resource ownership to business units for faster incident notification and accountability.

Module 7: Managing Alert Triage and Incident Prioritization

Implement a risk-based scoring model (e.g., CVSS adapted for detection) to rank alerts by exploitability and asset criticality.
Assign tiered SOC staffing based on alert volume patterns, increasing coverage during business hours or high-threat periods.
Define escalation criteria for Level 1 analysts, including mandatory review for any detection involving crown jewel assets.
Use automated enrichment (e.g., pulling user role, device patch status) to reduce manual investigation time per alert.
Conduct weekly alert review meetings with threat intel and IR teams to refine prioritization logic based on recent campaigns.
Track mean time to acknowledge (MTTA) and mean time to escalate (MTTE) as operational KPIs for detection efficacy.
Suppress alerts during authorized penetration tests using dynamic maintenance windows in the SIEM.
Document false positive root causes to feed back into detection rule tuning processes.

Module 8: Conducting Detection Efficacy Testing and Red Teaming

Run purple team exercises to validate detection coverage for specific adversary TTPs, adjusting rules based on simulation outcomes.
Measure detection coverage as a percentage of MITRE ATT&CK techniques relevant to the organization’s threat model.
Use automated breach simulation tools to test detection of phishing, lateral movement, and data exfiltration in production.
Compare internal detection timelines with external breach notifications (e.g., from law enforcement or ISACs) to identify gaps.
Assess dwell time detection capability by analyzing historical logs after a confirmed incident to determine first observable indicator.
Require third-party penetration testers to report undetected actions for inclusion in detection backlog.
Track time from initial compromise to alert generation in tabletop exercises involving IT, SOC, and executive teams.
Update detection playbooks annually based on lessons from red team findings and real-world incidents.

Module 9: Governing Detection Operations through Policy and Compliance

Document detection policies to satisfy audit requirements from frameworks such as ISO 27001, NIST CSF, and SOC 2.
Conduct quarterly access reviews for detection system consoles, removing privileges for departed or reassigned staff.
Implement change control procedures for detection rule modifications, requiring peer review and testing before production deployment.
Retain audit logs of all detection system configuration changes to support forensic investigations and compliance audits.
Align detection practices with data privacy regulations, ensuring monitoring complies with employee privacy laws in multinational operations.
Report detection metrics (e.g., alert volume, false positive rate, mean detection time) to the board and risk committee quarterly.
Enforce encryption of stored detection data, especially when logs contain PII or credentials in cleartext.
Establish data sharing agreements when outsourcing SOC functions, defining responsibilities for breach detection and notification.

Module 10: Evolving Detection Capabilities in Response to Threat Landscape Shifts

Subscribe to sector-specific ISAC threat feeds and integrate new TTPs into detection rules within 72 hours of publication.
Reassess detection coverage annually based on changes in business operations, such as M&A activity or cloud migration.
Adopt machine learning models for anomaly detection only after validating performance on historical breach data.
Phase out legacy detection tools (e.g., signature-based AV) when EDR and behavioral analytics demonstrate superior coverage.
Investigate detection gaps exposed by near-miss incidents, even if no data was compromised.
Benchmark detection maturity against peer organizations using frameworks like CIS Controls or NIST IR lifecycle.
Allocate budget for detection tool upgrades based on vendor EOL timelines and emerging attack vectors (e.g., supply chain).
Rotate detection engineering staff into threat intelligence and incident response roles to maintain operational relevance.