Description

A focused course, tailored for you

Detection Engineering for SOC Leaders

Measurable ATT&CK coverage, threat intel that produces live rules, and detection reporting your clients can take to their boards.

Most SOC teams can tell you what tools they run. Few can show a board a coverage map proving which adversary techniques they detect and which they miss. The gap between 'we have EDR and SIEM' and 'here is our documented detection coverage across the kill chain' is a detection engineering problem that tooling alone does not solve.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Security operations leaders at consulting firms and enterprise SOCs inherit the same structural problem: detection content accumulates by incident, not by strategy. A breach triggers a new rule. A client audit surfaces a gap. The ATT&CK framework is pinned to a wall but nobody has mapped the SIEM logic against it. When a client CISO asks what techniques do we actually detect, the answer takes weeks to compile and the heatmap is usually embarrassing. This course builds the method to fix that systematically, starting with the detection backlog your team already has.

What you walk away with

Map your current detection content against MITRE ATT&CK and produce a coverage report a CISO can present to a board.
Write SIEM-agnostic detection rules in Sigma format that survive platform migrations without manual rework.
Build a threat intel operationalization workflow that converts a new threat actor report into live detection rules within two working days.
Validate your detection coverage through adversary emulation so you know which rules actually fire, not just which rules exist.
Stand up a detection-as-code pipeline with version control and automated testing so new rules do not break existing coverage.
Structure the detection engineering function with hiring profiles, KPIs, and reporting cadence that connects coverage metrics to business risk.

The 12 modules

Module 1. The Detection Coverage Baseline

Running a structured coverage audit against your current SIEM rule set. How to tag each rule with the ATT&CK technique it addresses, identify duplicate coverage, and surface the techniques where no rule exists. Deliverable: a raw coverage map that shows, for the first time, exactly where the gaps sit. Most teams discover that their hardest-hit tactics (Lateral Movement, Command and Control, and Exfiltration) have the thinnest coverage.

Module 2. MITRE ATT&CK as an Operational Framework

ATT&CK is widely cited but rarely operationalized. This module walks through the tactic-technique-sub-technique hierarchy, how to prioritize sub-techniques by threat actor relevance to your sector, and how to use ATT&CK Navigator to build the coverage heatmap your client stakeholders can read at a glance. Focus: making ATT&CK useful to working detection engineers, not just to strategy decks.

Module 3. Writing Detection Logic in Sigma

Sigma is the vendor-neutral format for detection rules. Learn to write rules that convert cleanly to Splunk SPL, Microsoft KQL, and Chronicle YARA-L without rewriting from scratch. Includes the field normalisation patterns that trip up most migrations, the logsource abstraction model, and the CI pipeline that validates rule syntax before deployment. Practical: every module includes a worked Sigma rule tied to a real ATT&CK technique.

Module 4. Threat Intelligence Operationalization

A threat intel feed is only valuable if it produces new detection rules. This module builds the workflow: from receiving a new threat actor report to extracting TTPs, mapping them to ATT&CK, prioritizing against your existing coverage, and writing the detection rule within two working days. Includes the STIX/TAXII integration pattern for automated indicator ingestion and the analyst workflow that keeps the backlog from piling up.

Module 5. Alert Triage and Enrichment Workflows

Mean time to triage is the metric most SOC leaders report upward and almost none have systematically reduced. This module builds the triage playbook structure: how to enrich an alert with context from threat intel, asset inventory, and identity stores before it reaches an analyst queue, and how to build the decision tree that separates high-confidence detections from low-fidelity noise that analyst time should not touch.

Module 6. Detection-as-Code and CI/CD Pipelines

Version-controlling detection content in Git and running automated tests before deployment. Covers the repository structure for a detection-as-code practice, the CI pipeline that runs Sigma compilation and rule backtesting against historical log samples, and the review workflow that prevents untested rules from shipping to production SIEM. Deliverable: a working GitHub Actions pipeline stub tuned for detection content management.

Module 7. Adversary Emulation for Detection Validation

You cannot know whether your detections fire until you run an adversary simulation against them. This module covers Atomic Red Team for technique-level testing, Caldera for automated adversary emulation campaigns, and the reporting workflow that maps simulation results back to your ATT&CK coverage heatmap. Outcome: a validated coverage report that distinguishes a rule that exists from a rule that fires reliably when the technique is executed.

Module 8. Coverage Reporting for Executive Stakeholders

The ATT&CK heatmap is the deliverable your client CISOs need for board presentations and regulatory conversations. This module builds the heatmap in Navigator, structures the written narrative that explains coverage gaps in business terms, and adds the roadmap section showing which gaps close in the next quarter. Includes the one-page brief format that security operations leaders use to communicate SOC capability without losing a board audience in technical detail.

Module 9. Threat Hunting as a Detection Feedback Loop

Structured threat hunting is not a separate function; it is the process that generates new hypotheses and new detection rules. This module builds the hunting cycle: hypothesis generation from threat intel and coverage gaps, log analysis workflow, pivot methodology, and the handoff process that converts a confirmed hunt finding into a permanent detection rule added to the coverage baseline. Deliverable: a repeatable hunt workflow documentation template.

Module 10. Cloud Detection Engineering

Enterprise environments have moved workloads to cloud platforms, and detection coverage has not kept pace. This module covers detection logic for AWS CloudTrail, Azure Activity Log, and GCP Audit Log, the ATT&CK techniques most commonly executed in cloud environments (identity abuse, misconfiguration exploitation, and storage access), and the SIEM integration pattern that normalises cloud log fields into the same detection pipeline as on-premises telemetry.

Module 11. SOAR Playbook Integration

A detection that fires but requires manual analyst steps for every true positive is not finished. This module builds the SOAR playbook structure that automates the response actions most commonly triggered by high-confidence detections: account isolation, IP block, ticket creation, stakeholder notification. Covers the integration patterns for the three major SOAR platforms and the quality bar a playbook must meet before detection engineering hands it off to SOC operations.

Module 12. Building the Detection Engineering Function

Whether you are standing up a detection engineering team inside a consulting practice or within an enterprise SOC, the function needs the right hiring profiles, a capability ladder for engineers, and the KPIs that connect detection coverage metrics to business risk. This module provides the job description templates, the 90-day plan for a new detection engineering hire, and the quarterly review cadence that keeps coverage improvement on track against the threat actor priorities your sector faces.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Modules 1-3 address the coverage audit and detection writing problem: how to know what you actually detect, and how to write rules that survive platform changes.

Modules 4-6 address the operational cadence problem: how to operationalize threat intel feeds and version-control detection content so coverage improves continuously.

Modules 7-9 address the validation and hunting loop: how to know whether your rules fire and how structured hunting produces new permanent coverage.

Modules 10-12 address the scaling problem: cloud coverage gaps, SOAR automation, and building the detection engineering function with the right team structure and metrics.

What you get with this course

12 written modules in the Art of Service learning environment
Downloadable Sigma rule templates for 24 high-priority ATT&CK techniques
ATT&CK coverage mapping worksheet for auditing your existing SIEM rule set
Threat intelligence operationalization workflow template
Detection engineering function hiring profiles and KPI framework
Hand-built implementation playbook tailored to your SOC context and role, delivered alongside course access

What you will have in hand by Day 1, Week 1, Month 1

Day 1: Course access provisioned and implementation playbook delivered.

Weeks 1-2: Modules 1-6, covering the coverage audit, detection writing, and threat intel workflow.

Weeks 3-4: Modules 7-12, covering validation, cloud detection, SOAR integration, and function building.

Ongoing: All templates and the implementation playbook remain available as working reference material.

Before and after

Before

You know your SIEM has rules and your team responds to alerts. You cannot produce a coverage map against ATT&CK without weeks of manual work, and the client CISO board question about detection capability gets answered with a tool list.

After

You have a documented ATT&CK coverage baseline, a detection-as-code pipeline for new rules, a threat intel workflow that produces live detections within two working days, and a coverage report your client CISOs can take to their boards.

What happens if you do not address this

Detection gaps are invisible until a breach makes them visible. Every quarter without a structured coverage methodology is a quarter where adversary techniques in Lateral Movement and Exfiltration go undetected, not because you lack telemetry, but because nobody mapped the rules to the techniques.

Who it is for

Security operations leaders and detection engineers who have accountability for SOC capability delivery, whether inside a consulting practice advising enterprise clients or leading an internal function. You have SIEM access, you have threat intel feeds, and you have analysts writing rules reactively. This course teaches you to run the function proactively.

Who this is NOT for. Analysts who are only beginning to learn SIEM syntax. This course assumes you already operate a SOC or detection engineering function and want to build structured coverage against a known adversary model.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. 3-4 hours per week over four weeks. Each module is designed to be read, applied to your current rule set, and revisited. The implementation playbook provides the structural shortcut for your specific SOC context.

Why $199 is the right number

An external detection engineering maturity assessment typically costs $50,000-150,000 and takes 8-12 weeks, with a report that lands on a shelf. Hiring a detection engineering lead runs $180,000-220,000 per year with 3-6 months to productivity. This course gives you the methodology and the templates for $199.

FAQ

Is this relevant if my team uses Microsoft Sentinel rather than Splunk?

Yes. The detection logic module uses Sigma as the vendor-neutral format, with worked translation examples for both Splunk SPL and Microsoft KQL. The coverage methodology and threat intel workflow are platform-independent.

My team advises clients on SOC builds rather than running one internally. Is this still applicable?

This course is written specifically for that context. The coverage reporting module is structured around what client CISOs need for board presentations, and the function-building module addresses both in-house and consulting delivery models.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.