Description

A focused course, tailored for you

The Hyperscaler Security Engineer Detection-Engineering Playbook

Turn raw telemetry into high-signal detections that survive SRE review, red-team rotation, and a CISO quarterly metrics readout.

A Sev-2 detection page at 02:41 that turned out to be a noisy rule, not a real incident. The on-call write-up the next morning promises tuning. Three weeks later the same rule fires again.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Security engineers inside hyperscale environments sit on a constant tension. Telemetry volume is enormous, the detection backlog is partly inherited and partly home-grown, and the on-call rotation absorbs the noise instead of the rule library getting smaller and sharper. The loop between an alert firing, the triage outcome, and the rule change that prevents the next false positive is rarely closed in a structured way. As a result, three things happen. Coverage gaps survive longer than they should because nobody has time to dig back through 30 days of warm telemetry to backtest a candidate rule. False-positive budgets are debated emotionally instead of quantitatively. And the metrics readout to the CISO or to the security review board stays anchored on lagging volume counts (alerts, tickets, MTTR) instead of leading signal (coverage of high-value MITRE techniques, time-to-detect-from-test-event, false-positive rate per rule per quarter). The skill that closes this is detection engineering as a discipline, treated with the same rigour the rest of the engineering org applies to a service: versioned, tested, monitored, owned, on an SLO.

What you walk away with

Run detection engineering as a code discipline with versioning, testing, and code review on every rule change.
Backtest a candidate detection against 30 days of warm telemetry before it ships to the on-call queue.
Quantify a false-positive budget per rule and per rule family, and defend it in a review board with data.
Close the loop from triage feedback to rule delta within one on-call rotation, not one quarter.
Present a CISO-ready quarterly readout built on leading indicators: coverage of high-value techniques, time-to-detect, false-positive rate.
Run a purple-team exercise that produces a measurable rule delta and a tuned false-positive budget, not a slide deck.

The 12 modules

Module 1. Telemetry inventory and source-of-truth mapping

Walk the recipient through cataloguing every telemetry source feeding the detection platform: EDR events, identity logs, network flow, application logs, cloud audit. For each source, document the retention tier, the field schema, the trust level, and the latency from event to ingestion. The output is a single source-of-truth map that every detection in modules 3 through 11 references. Without this map, rule authoring collapses into guesswork about what fields are actually populated in production.

Module 2. Detection as code: monorepo, branches, code review

Set up the detection library as a versioned monorepo with the same code-review discipline a service team would use. Branch per rule change, PR template that demands a backtest result, CODEOWNERS by rule family, CI that runs syntax and schema validation on every push. The course walks through a sample monorepo layout, a sample PR template, and the exact checks a CI pipeline should run before a rule is mergeable to main.

Module 3. From MITRE technique to candidate rule

Pick a single high-value MITRE ATT&CK technique. Walk through the procedure to translate it into a candidate detection: which sub-techniques apply in this environment, which telemetry sources cover them, which fields and value patterns to look for, and how to express the logic in the platform DSL. The output is one fully-formed candidate rule per recipient, anchored on a technique that matters to a hyperscaler threat model.

Module 4. Sigma as an interchange format

Use Sigma to express detection logic in a vendor-neutral way, then convert to the internal DSL. The course covers the Sigma schema, the common conversion gotchas (field name mismatches, log-source aliasing, value escaping), and a worked example of a Sigma rule converted into three different target DSLs. Treat Sigma as the interchange format so that detection logic is portable across platform changes.

Module 5. Backtesting against warm telemetry

Run a candidate rule against the last 30 days of warm storage before it ever ships to the on-call queue. The module covers query optimisation for warm-tier scans, sampling strategies when 30 days is too large to scan exhaustively, how to read the noise distribution per identity, per service, and per source IP space, and what threshold the false-positive rate must clear before the rule is merge-ready. The artefact is a backtest report attached to the rule PR.

Module 6. False-positive budgets per rule and per family

Quantify a false-positive budget the same way an SRE team quantifies an error budget. Define the budget per rule (events per week that are tolerable as noise), per rule family (combined budget for all rules tagged with a given technique or actor), and per on-call rotation (combined noise floor across the entire library). Walk through how to defend the budget in a review board with backtest data and triage outcomes rather than opinion.

Module 7. Triage feedback as a structured input

Build the loop from on-call triage back to rule authoring as a structured data flow, not an ad-hoc Slack message. Define the triage outcome schema: true positive with severity, false positive with root cause category, benign-but-noisy, needs more context. Aggregate triage outcomes per rule per week. Set the threshold at which a rule auto-enters the tuning queue. The output is a triage feedback dashboard the on-call shift can update in under 30 seconds per alert.

Module 8. Tuning safely: shadow mode, A/B, and rollback

Walk through how to tune a noisy rule without losing coverage. Ship the candidate change in shadow mode so it logs what it would have done without firing alerts. A/B the new logic against the old on the same telemetry stream. Define rollback criteria up front so the change can be reversed inside one on-call shift. Worked example: a noisy identity rule taken from 14 false positives per week to under 2.

Module 9. Purple-team exercises that produce rule deltas

Structure a purple-team exercise so the output is a measurable change to the detection library, not a write-up. Define the test event set up front. Run the events through the production telemetry path. Measure which fired, which fired late, which never fired. Each gap maps to a candidate rule change with a backtest result attached. The artefact is a rule-delta report that ships into the same PR review flow as any other change.

Module 10. Coverage metrics that survive a CISO readout

Move the quarterly metrics readout off lagging volume counts and onto leading detection signal. Define three metrics that a CISO can defend at a board level: coverage of high-value MITRE techniques expressed as percent of sub-techniques with at least one tuned rule, median time-to-detect from a synthetic test event injected weekly, and false-positive rate per rule family per quarter. The module includes a slide template and the SQL or Splunk-style queries that produce each metric.

Module 11. On-call ergonomics and runbook coupling

Every detection needs a runbook the on-call shift can execute in under 5 minutes. Module covers the runbook template (what to check first, what to escalate, what to suppress), the coupling between rule changes and runbook changes so a PR that updates detection logic without updating the runbook fails CI, and the suppression mechanics that prevent a known false-positive pattern from paging the rotation eleven times.

Module 12. Threat-intel feed and rule-library lifecycle

Run the detection library on a lifecycle that absorbs threat-intel updates without bloating the rule count. Define the intake path for new IOCs and TTPs from the threat-intel team. Define the retirement path for rules whose technique is no longer relevant or whose false-positive cost outweighs the catch rate. Define a quarterly rule-library audit that walks every rule against coverage, false-positive rate, and last-true-positive date.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

A noisy detection rule paged on-call at 02:41 last week. The course covers how to ship the tuning change inside one on-call rotation, not one quarter (modules 7 and 8).

Coverage of a new MITRE technique was requested by threat-intel and the candidate rule has been sitting in draft for three weeks. Modules 3, 4, and 5 cover how to take that candidate from MITRE technique to merged rule with a backtest result attached.

The quarterly CISO readout has been anchored on alert volume and MTTR. Module 10 covers how to move it to leading indicators the CISO can defend at a board level.

A purple-team exercise is scheduled this quarter. Module 9 covers how to structure it so the output is a measurable change to the detection library, not a slide deck.

What you get with this course

Twelve written modules in the Art of Service learning environment, each with worked examples drawn from a hyperscaler detection-engineering practice.
Downloadable templates for each module: the telemetry source-of-truth map, the rule PR template, the backtest report format, the false-positive budget calculation, the runbook template, the CISO readout slide template.
A reference monorepo layout for the detection library, including the CI checks and the CODEOWNERS structure.
The hand-built implementation playbook delivered alongside course access, tuned to the recipient's actual stack on intake.
Thirty-day money-back guarantee.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: account provisioned in the Art of Service learning environment.

Within 24 hours: hand-built implementation playbook delivered alongside course access, tuned to the recipient's stack.

Module 1 through module 6 are typically worked through in the first two weeks.

Module 7 through module 12 ship the loop from triage feedback into rule lifecycle and the CISO readout.

Before and after

Before

Detection logic is shipped through tribal knowledge. Tuning loops take a quarter. The CISO readout is anchored on alert volume. Purple-team output is a slide deck.

After

Detection runs as a code discipline. Tuning ships inside one on-call rotation. The CISO readout is anchored on coverage of high-value techniques and time-to-detect. Purple-team output is a measurable rule delta.

What happens if you do not address this

The detection library keeps growing, the on-call rotation keeps absorbing noise, the quarterly metrics readout stays flat on lagging indicators, and the gap between threat-intel velocity and the rule library widens until the next incident review exposes a coverage gap that has been visible in the telemetry for months.

Who it is for

A mid-to-senior security engineer inside a hyperscaler or a very large platform company. Owns a slice of the detection library. On-call rotation through a 24x7 detection and response queue. Sits between the SOC analysts who triage and the threat-intel and red-team functions that propose new detections. Reads MITRE ATT&CK fluently, has used Sigma at least once, writes rules in whatever internal DSL the SIEM or detection platform exposes. Comfortable with code review, comfortable with backlog grooming, less comfortable with the quarterly metrics readout that asks for leading indicators rather than ticket counts.

Who this is NOT for. SOC analysts who triage queues full time but do not write rules. Security generalists who manage a vendor SIEM without owning the detection logic. Pure red teamers who build exploits but never feed findings back as detection deltas. CISOs who only need the metrics view, not the engineering practice underneath it.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 90 minutes per module of reading and worked examples. The implementation playbook adds practical work against the recipient's actual stack and is sized to the recipient's environment on intake.

Why $199 is the right number

A SANS detection-engineering course covers similar ground at roughly 30 times the price and ships generic templates. Vendor-led detection-engineering training tends to anchor on the vendor's DSL rather than on the practice itself. Free MITRE ATT&CK content covers the technique catalogue but does not cover the lifecycle from triage feedback to rule delta. This course is opinionated on the practice and ships the templates and the implementation playbook against the recipient's stack.

FAQ

Do I need to use a specific SIEM or detection platform?

No. Detection logic is expressed in Sigma as the interchange format and the conversion notes cover the most common target DSLs. The implementation playbook is tuned to the recipient's actual platform on intake.

How much of this assumes a hyperscaler environment specifically?

The module structure assumes high telemetry volume, a 24x7 on-call rotation, and a meaningful internal threat-intel function. Recipients at smaller scale can still apply the practice, with the false-positive budgets and the metrics readout scaled down to the environment.

What format are the modules delivered in?

Written modules in the Art of Service learning environment with downloadable templates and worked examples, plus the hand-built implementation playbook delivered alongside course access.

What does the hand-built implementation playbook cover?

It is tuned to the recipient's stack on intake. Typically that includes the rule PR template adapted to the recipient's monorepo conventions, the false-positive budget calculation against the recipient's actual alert volume, and the CISO readout template populated with the recipient's coverage data.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.