Description

A focused course, tailored for you

Detection Engineering for GSOC Leads

A structured methodology for GSOC supervisors to convert red team findings into validated detection rules, reduce false positive fatigue, and build a coverage program that keeps pace with current adversary behavior.

Your detection gap list from the last red team exercise is still longer than your closed-ticket list. The ATT&CK techniques that went undetected are documented. The rules to catch them are not yet written, tested, or validated. Every week that passes is a week those techniques remain live gaps in your coverage.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A Global Security Operations Center runs on detection logic. When that logic drifts, the gap between what your SIEM catches and what adversaries are actually doing widens silently. Tier-1 analysts triage alerts against runbooks calibrated to an older environment. False positive rates climb. Fatigue rises. Real signals get buried. A GSOC supervisor sees the symptoms: MTTD creeping up, tier-2 re-classifying tier-1 escalations, red team findings that recur quarter after quarter. The root cause is almost always the same: detection rules are written and forgotten rather than written, validated, and maintained as a living program.

What you walk away with

Produce a detection coverage map aligned to MITRE ATT&CK that shows exactly where your current rules provide coverage and where they do not.
Convert red team and threat intelligence findings into a prioritized detection tuning backlog with clear validation criteria for each rule.
Build a fidelity baseline for your SIEM that measures true positive rate, false positive rate, and analyst fatigue per detection category.
Run a structured weekly detection review that improves coverage incrementally without requiring a dedicated red team or purple team budget.
Present detection program progress to security leadership using metrics that connect to business risk rather than just alert volume.

The 12 modules

Module 1. The GSOC Detection Lifecycle

Every detection gap starts with the same breakdown: something happened in the environment, the SIEM saw data about it, and no alert fired. This module maps the full detection lifecycle from threat intelligence intake through rule authoring, testing, deployment, and analyst-facing runbook update. You leave with a coverage map that shows where your current detection program has genuine gaps versus where it has rules that are untriaged noise.

Module 2. Reading a Red Team Report as a Detection Engineer

Most GSOC supervisors read a red team report as a list of findings. This module teaches you to read it as a detection backlog. You will map each finding to the MITRE ATT&CK technique it exercised, check whether your current rule set would have fired on that technique, and produce a prioritized tuning backlog that feeds the next four weeks of detection work rather than sitting in a ticket queue.

Module 3. SIEM Fidelity Baseline

Before you can tune, you need to measure. This module walks through pulling false positive and true positive rates per detection category from your SIEM, building a fidelity baseline table, and identifying which rule clusters are generating the most analyst fatigue without catching real threats. You will produce a written fidelity report you can present to a security director as the starting point for a structured tuning program.

Module 4. Writing Detection Rules That Hold

Detection rules written under pressure and pushed to production without validation become next month's noise problem. This module covers the anatomy of a well-formed detection rule: scope boundaries, exclusion logic, severity calibration, and the testing matrix you run before any rule touches a production SIEM. It also covers SIGMA format as a portable rule standard so detection logic is not locked to a single platform or vendor.

Module 5. Tier-1 Runbook Calibration

A runbook written when the threat landscape looked different produces wrong escalation decisions today. This module takes the escalation criteria in your current tier-1 runbook and walks through a systematic calibration process: compare each threshold against recent adversary TTPs, identify where the criteria are too broad or too narrow, and update escalation logic to match the environment your analysts are actually working in rather than the environment that existed at initial deployment.

Module 6. Operationalizing Threat Intelligence

Most SOC teams subscribe to threat intelligence feeds and read the reports. Few convert indicators and TTPs into detection rules within a useful timeframe. This module builds a 48-hour operationalization workflow: how to assess a new TI report for detection relevance, draft a rule hypothesis, test it against historical telemetry, and push a validated rule to your SIEM before the adversary has moved past the technique the report covers.

Module 7. MTTD and MTTR as Leading Indicators

Mean time to detect is a lagging indicator. By the time it spikes, the damage is done. This module teaches you to build leading indicators from detection program data: how many ATT&CK techniques you have coverage for in each kill chain phase, what percentage of tier-1 alerts are being re-classified by tier-2, and which shift windows show systematic coverage gaps. You leave with a metrics dashboard designed for a security director audience.

Module 8. The Weekly Detection Review

A structured weekly review is the mechanism that converts continuous monitoring into continuous improvement. This module gives you a 90-minute agenda: fidelity metrics from the past seven days, open items from the previous review, one new detection rule reviewed and validated per session, and a ten-minute scan of current threat intelligence for techniques not yet covered in your rule set. Includes a facilitator guide and a tracking template you can use from the first session.

Module 9. Shift Handover and Context Preservation

The highest-risk moment in a GSOC is shift handover. Ongoing investigations lose context, re-escalation decisions get made without the full timeline, and tier-2 analysts inherit incomplete incident pictures. This module builds a handover documentation standard: what information must be preserved per open investigation, how to structure the handover brief, and how to audit handover quality so that context loss becomes visible and correctable before it produces a missed escalation.

Module 10. Purple Team Exercises for Detection Validation

A purple team exercise does not require a dedicated red team. This module covers the lightweight adversary simulation your GSOC can run internally to validate new detection rules before incidents do it for you. You will learn how to scope a one-day purple exercise, which ATT&CK techniques to test first based on your current gap list, how to document results, and how to feed findings back into the tuning backlog with clear acceptance criteria.

Module 11. GSOC Metrics for Security Leadership

The metrics that matter to your tier-1 analysts are not the metrics that move a CISO. This module covers the translation layer: how to present detection coverage, false positive reduction progress, and MTTD improvement in terms that connect to business risk, regulatory audit findings, and budget decisions. Includes a slide template for quarterly security operations briefings and a one-page metrics summary formatted for security leadership review.

Module 12. Detection-as-Code Pipeline

Manual rule management does not scale past a certain alert volume or team size. This module covers the principles of detection-as-code: storing detection rules in version control, building a testing pipeline that validates rules against historical telemetry before deployment, and running peer review on detection logic the same way a software team reviews code. You leave with a pipeline design document sized to your team's current tooling and headcount.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

You receive a red team report with ATT&CK gaps and have no structured process for converting it to detection work (Modules 2, 10).

Your tier-1 analysts are fatigued by false positives and you do not know which rule clusters are responsible (Modules 3, 4, 5).

Shift handover keeps losing investigation context and you are seeing re-escalation errors (Module 9).

Your CISO wants quarterly detection metrics and you are not sure which numbers actually matter (Modules 7, 11).

What you get with this course

12 written modules covering the full detection engineering lifecycle for GSOC supervisors.
Downloadable templates: detection coverage map, SIEM fidelity baseline table, weekly detection review agenda, shift handover standard, tier-1 runbook calibration worksheet.
A hand-built implementation playbook sized to your team's shift structure, SIEM platform, and current gap list.
Access to the Art of Service learning environment within 24 hours of purchase.

What you will have in hand by Day 1, Week 1, Month 1

Access to the learning environment within 24 hours of purchase.

Hand-built implementation playbook delivered alongside course access.

Before and after

Before

Red team findings sit in a ticket queue. MTTD creeps up and you do not know which shift window or rule cluster is responsible. Tier-1 triages against criteria that have not been updated in over a year. The gap list grows faster than it closes.

After

You run a weekly detection review that converts gap findings into validated rules. Your fidelity baseline tells you exactly which rule clusters are producing noise. Tier-1 runbooks are calibrated to current adversary behavior. You present a coverage map to your CISO instead of a ticket count.

What happens if you do not address this

Detection logic that drifts is an adversary's best resource. Every unpatched gap in your coverage is a technique that can be used against your environment without generating an alert. The longer the gap list sits unaddressed, the wider the window for an incident your SIEM technically saw data for but your detection logic did not fire on.

Who it is for

This course is for GSOC supervisors and SOC team leads who own detection quality in a large enterprise environment. You manage tier-1 and tier-2 analyst teams, receive red team and threat intelligence reports, and are accountable to a security director or CISO for MTTD, MTTR, and coverage metrics. You know your current detection program has gaps. This course gives you the methodology to measure those gaps, close them systematically, and build a detection review process that keeps coverage current.

Who this is NOT for. This course is not for entry-level security analysts still learning to triage alerts, nor for CISOs seeking an executive overview of SOC operations. It is built for the supervisor or team lead who already runs the operations and needs a structured approach to improving detection quality rather than just alert throughput.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Approximately 3 to 4 hours per module, designed for completion over 4 to 6 weeks alongside active GSOC operations. The weekly detection review module is designed to be implemented immediately, not after you complete the full course.

Why $199 is the right number

SANS SOC curriculum covers incident response and monitoring fundamentals, not detection engineering as a program management discipline for supervisors. Detection engineering conference talks give you technique exposure without structured implementation methodology. Internal red team collaboration gives you gap identification without the workflow to close gaps systematically. This course is the implementation bridge between knowing what your gaps are and having a repeatable process that closes them.

FAQ

My SIEM is platform-specific. Will this course still apply?

Yes. The methodology is platform-agnostic. Rule logic examples are written in SIGMA format, which translates to Splunk, Microsoft Sentinel, Elastic, and other major SIEM platforms. The implementation playbook is adapted to your specific environment.

We do not have a dedicated red team. Can we still run purple team exercises?

Module 10 is specifically designed for teams without dedicated red team resources. The lightweight adversary simulation approach uses atomic tests and technique emulation that your GSOC team can run internally without specialized offensive security expertise.

How much of this is theory versus hands-on implementation?

The ratio is approximately 30 percent methodology and 70 percent implementation. Every module concludes with a specific deliverable: a template completed, a process document drafted, or a metric calculated. The implementation playbook ties all module outputs into a coherent program.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.