Description

A focused course, tailored for you

The Security Engineer's Detection Hand-Off Playbook

Turn ad-hoc alert triage into documented detection logic the on-call rotation can run without paging you at 2 a.m.

You are the documented point of escalation for detections you have never written down. The on-call rotation pages you because the runbook says "ask the security engineer." That is a control gap, an availability risk, and a reason you have not taken a real vacation in 18 months.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A security engineer at a hyperscaler sits at the intersection of three pressures. The detection backlog grows faster than the team. The on-call rotation can only escalate to whoever wrote the query, so escalation defaults to you. And the assurance function has started asking for evidence that detections are reviewed, peer-approved, and operable by anyone in the on-call pool, not just the author. The work that closes all three pressures at once is the same work: take each detection you privately maintain, document the data sources, the threshold logic, the false positive expectations, the severity routing, and the response runbook, then peer-review it into a state where someone else in the rotation can run it cold at 2 a.m. without paging you. Most engineers know they should do this. Almost nobody has the templates, the review cadence, or the evidence pack ready when the auditor asks. This course gives you all three.

What you walk away with

Document every detection you privately maintain in a peer-reviewable format the on-call rotation can run cold.
Reduce 2 a.m. pages routed to you by name by at least 60 percent within one quarter.
Produce an evidence pack a SOC 2 or ISO 27001 auditor can sample without follow-up questions.
Run a quarterly detection-review cadence with a documented false positive budget per detection.
Promote one detection per week from private notebook to peer-reviewed, runbook-linked control.

The 12 modules

Module 1. Inventory: every detection you actually own

Build the private inventory of detections you maintain across SIEM saved searches, scheduled notebooks, EDR custom rules, cloud audit log queries, and the SQL you run by hand when something feels off. Tag each one with data source, current owner, last-modified date, and whether anyone else can run it cold. The output is the work backlog for the rest of the course.

Module 2. The detection spec: from query to documented control

For each detection, write the spec the runbook will reference. What the detection looks for in plain English. The MITRE ATT&CK technique it maps to. The data sources and retention windows it depends on. The threshold logic and why it sits there. The expected false positive rate and what a true positive looks like at 3 a.m. Template included.

Module 3. Severity, routing, and the on-call decision tree

Decide which detections page, which open a ticket, and which roll up to a daily digest. Write the severity matrix and the routing logic into the SIEM or the on-call platform. Document the escalation tree so the rotation knows when to wake up a tier-three engineer and when to handle it themselves. Removes you from the default escalation path.

Module 4. False positive budget per detection

Set a per-detection false positive budget. Five percent of alerts on this detection are allowed to be false. Above that, the detection enters tuning queue. Below that, it is healthy. Track the budget in a dashboard the team reviews weekly. This turns detection tuning from a feeling into a number management understands.

Module 5. The peer review cadence

Stand up a weekly or biweekly detection-review meeting. Two engineers, one detection at a time, the spec from module two, the budget from module four, the runbook from module six. Approve, reject, or send back for revision. Captured as a Git commit with reviewer name. The auditor will ask for this artefact next year.

Module 6. Runbook: what the on-call engineer does next

For each approved detection, write the response runbook. Triage questions, containment steps, evidence preservation, escalation criteria, customer communication template if applicable. The runbook lives next to the detection in the same repo. The on-call engineer reads it, follows it, and pages you only if it explicitly says to.

Module 7. Threat model linkage and ATT&CK coverage

Map every documented detection to a MITRE ATT&CK technique and to the threat model that justifies it. Identify coverage gaps where the threat model says "we should detect X" and no detection exists. Feed the gaps back into the detection backlog. The coverage matrix becomes a quarterly conversation with your director.

Module 8. The evidence pack auditors will ask for

Build the artefact pack a SOC 2 Type 2 or ISO 27001 auditor will sample. Detection spec, peer review record, false positive budget history, runbook version, last-tested date, and a sampling of alert outcomes. Store it where the audit team can pull it without paging you. Walks through the questions auditors ask and the documents that answer them.

Module 9. Detection-as-code: the repo and the CI pipeline

Move detections out of the SIEM UI and into a version-controlled repo. Use Sigma or a vendor-native YAML format. Wire a CI pipeline that lints syntax, runs a backtest against historical data, and posts a diff to the peer review channel. Every change is a pull request. Every approval is captured. The audit evidence collects itself.

Module 10. Backtest and replay: validating before promotion

Before a detection leaves draft, replay it against three months of historical telemetry. Measure precision, recall, and time-to-alert. Compare against the budget you set in module four. Reject anything that exceeds the budget on history before it ever sees production traffic. Notebook and replay harness included.

Module 11. The hand-off plan: removing yourself as the named escalation

For each documented detection, formally hand off the named escalation from you to the on-call rotation, then to a backup rotation, then to a manager. Update the runbook, the paging rules, and the team wiki. Track the count of detections where you are still named. Drive it to zero. This is the deliverable that gives you a vacation.

Module 12. The quarterly detection review with leadership

Run a quarterly review with your director and the assurance function. Coverage matrix, false positive budgets, peer review throughput, audit evidence sample. Frame each detection as a control under continuous improvement. The conversation shifts from "are we secure" to "here is our evidence and here is the queue." Promotion case material if you want it.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Your most-used Splunk query at 2 a.m. is a saved search nobody has ever reviewed.

The runbook for a Sev2 reads "ask Rafaan." You are on vacation.

The auditor asks for evidence of peer-reviewed detections covering ATT&CK initial access. You have a notebook.

Your manager asks why the false positive rate on a top detection doubled last quarter. There is no chart.

What you get with this course

12 written modules in the Art of Service learning environment.
Detection spec template, severity matrix template, false positive budget tracker.
Runbook skeleton with triage, containment, evidence preservation, and escalation sections.
Sigma starter pack with three worked examples translated from SPL.
CI pipeline reference configuration for detection-as-code.
Backtest and replay notebook with sample telemetry.
Audit evidence pack template aligned to SOC 2 CC and ISO 27001 Annex A controls.
Hand-built implementation playbook tailored to your stack, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours: learning environment access and the hand-built implementation playbook for your stack.

Week one: complete modules one and two, inventory done, first detection spec drafted.

Week two: modules three through five, first peer review meeting scheduled.

Week four: modules six through eight, first detection fully documented end to end with runbook and evidence pack.

Week six to eight: detection-as-code repo live, CI pipeline running, backtest harness in place.

Week ten to twelve: hand-off plan executed, quarterly review meeting on the calendar with leadership.

Before and after

Before

You are the named escalation for every Sev2 detection your team runs. The runbook reads "ask Rafaan." Half your detections live in a private notebook. The audit team asks for evidence and you spend a Saturday compiling screenshots. You have not taken five consecutive days off in 18 months.

After

Every detection you own has a peer-reviewed spec, a false positive budget, a runbook, and a backtest record. The on-call rotation handles Sev2 without paging you. The audit team pulls evidence from the repo without asking. Your name appears on zero runbooks as the named escalation. You took last week off.

What happens if you do not address this

The detection backlog grows. Your on-call burden grows with it. The next SOC 2 audit cycle asks pointed questions about detection ownership and review cadence and the answers are not ready. A peer with a quieter on-call rotation gets the promotion you wanted because she had time to write the design doc you did not. You leave for a job at a smaller company because the only way out of being the named escalation is to stop being there.

Who it is for

Mid-to-senior security engineer inside a large product organisation. Owns a portfolio of detections across SIEM, EDR, cloud audit logs, and homegrown telemetry. Reports into a security operations or detection engineering manager. Has a strong technical reputation, a packed on-call rotation, and a quiet anxiety about the bus factor of the detections they carry. Familiar with Splunk SPL or Sigma, MITRE ATT&CK mapping, basic Python for log enrichment, and at least one cloud audit-log schema.

Who this is NOT for. Not for entry-level analysts who have never written a detection. Not for SOC managers who do not personally maintain detection logic. Not for compliance generalists looking for a checkbox course. The material assumes you can read a query, reason about false positive rates, and have at least one detection in your portfolio you would rather not hand off.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Two to three hours per week for twelve weeks. Most of the work is on detections you already own, so the time substitutes for triage time you are already spending.

Why $199 is the right number

SANS detection engineering courses cover the craft but stop at the spec. Vendor certifications cover the product but not the audit evidence layer. Free MITRE ATT&CK material covers the taxonomy but not the peer review cadence. This course assembles the three layers, spec plus operating cadence plus audit pack, into one set of templates and one implementation playbook.

FAQ

Do I need to use Sigma?

No. The detection-as-code module includes a Splunk SPL track and a vendor-native YAML track. Sigma is the recommended path for portability, not a requirement.

Will my manager approve the time?

The hand-built playbook includes a one-page business case framing the work as reducing on-call escalations and pre-empting the next audit cycle. Most managers approve it on the first read.

How is the implementation playbook tailored?

Within 24 hours of purchase a playbook is hand-built referencing the detection portfolio shape you describe, the SIEM and cloud platforms you use, and the audit frameworks your org is preparing for. Delivered alongside course access.

Is there a refund policy?

Thirty-day money-back if the material does not match the brief. The implementation playbook is hand-built per buyer so refund requests are honoured on the course portion.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.