Description

A focused course, tailored for you

The Vendor-Side Detection Engineering Practice for XDR Specialists

Turn customer telemetry and threat intel into authored detections and hunt packages your customer SOC will actually run.

The customer SOC analyst says your tool missed it. You know the telemetry was there. You need a repeatable practice for shipping authored detections back to the customer, not a one-off rule per account.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Vendor-side cybersecurity specialists sit between the customer's SOC, sales engineering, threat intel and product. The post-sale work is a series of detection conversations: an analyst asking why a correlation rule did not chain two stages of an attack, a CISO asking which MITRE techniques are covered against an APT group named in last week's threat brief, an auditor asking which detections evidence which control. Writing a one-off rule for each account creates technical debt and never scales. What scales is a repeatable practice for ingesting customer telemetry, mapping it to ATT&CK, authoring detections with tuning rationales the customer can audit, and packaging hunts the customer's level-two analyst can run unchanged. This course builds that practice module by module. The output is a vendor-side detection engineering motion you can run across an account book without rewriting your method for every customer.

What you walk away with

Ship authored detections back to the customer with a documented tuning rationale and a false-positive budget the customer's SOC can audit.
Translate threat-intel reporting into customer-specific hunt packages the customer's level-two analyst runs unchanged.
Map customer telemetry against MITRE ATT&CK techniques and present a coverage delta the customer's CISO forwards to the board.
Run a vendor-side detection review the customer's SOC manager asks to repeat quarterly because the output is concrete.
Build an internal detection library you reuse across the account book instead of rewriting correlation logic per customer.

The 12 modules

Module 1. Reading customer telemetry before you write a detection

Customer SOCs send you raw EDR events, SIEM extracts and an occasional packet capture. This module walks the intake: distinguishing telemetry the customer has from telemetry they think they have, the four questions to ask the customer's SOC engineer before drafting any correlation rule, and the worked example of a Trend Vision One customer who claimed full process-creation coverage but was missing parent-process context across half their endpoints. Output is a one-page telemetry profile per customer account.

Module 2. Mapping the customer's coverage against MITRE ATT&CK

Detection coverage claims fall apart when the customer's CISO asks which sub-techniques are covered against a named APT group. This module walks the structured map: the ATT&CK Navigator layer per customer, the technique IDs you commit to detecting versus the ones explicitly out of scope, and how to present the coverage delta in a format the customer's auditor and the customer's SOC manager both find usable. Includes a worked example mapping a financial-services customer's coverage against an APT39-style intrusion chain.

Module 3. Authoring detections the customer's SIEM can run

A detection that runs only in your product is not a detection the customer's level-two analyst trusts. This module walks the cross-platform authoring discipline: writing the detection logic once in a vendor-neutral pseudo-code, generating the Splunk SPL, Sentinel KQL and Elastic EQL variants from it, and handing the customer the version their SOC actually uses. Includes the worked example of a credential-dumping correlation rule deployed to three different customer SIEM stacks from one source-of-truth.

Module 4. The tuning rationale document the customer's CISO forwards

Detections without a tuning rationale get switched off the first time they false-positive on a customer's CFO laptop. This module walks the rationale doc: the threat model the detection serves, the false-positive budget you committed to, the exclusion list and why each entry is there, and the review cadence. Includes the worked example of a PowerShell-encoded-command detection where the rationale doc was forwarded by the customer's CISO to the audit committee because it explained the tuning logic in three pages.

Module 5. Turning threat intel into a customer-ready hunt package

Threat-intel briefs arrive weekly and most of them die in the customer's inbox. This module walks the hunt package: the named TTPs from the brief, the queries the customer's analyst runs against their telemetry, the expected output shape, and the escalation path if the hunt finds something. Includes the worked example of a Volt Typhoon living-off-the-land brief turned into a hunt package three customer SOCs ran in the same week, two of which surfaced suspicious activity.

Module 6. The customer detection review meeting

A monthly detection review with the customer's SOC manager is the single highest-leverage meeting in the account. This module walks the structure: the agenda the customer asks you to repeat, the artefacts on the table (coverage map, tuning rationale doc, hunt package, false-positive log), the questions the customer's CISO will ask, and the two follow-up commitments you take away. Includes the worked example of a quarterly review the customer's CISO turned into a board slide on detection maturity.

Module 7. Building an internal detection library you reuse

Rewriting the same correlation logic per customer is the technical-debt trap that breaks the practice at scale. This module walks the internal library: the naming convention, the metadata schema, the versioning discipline, the test telemetry you keep for regression, and the review process before a detection is shipped to a customer. Includes the worked example of a vendor-side specialist who went from rewriting per account to reusing 80 percent of authored detections across the book.

Module 8. Handing the detection to the customer's level-two analyst

The detection ships when the customer's level-two analyst can run the hunt query without calling you. This module walks the handover: the documentation the analyst actually reads, the runbook for the alert chain, the escalation path inside the customer's SOC, and the one-page reference card the analyst pins next to their monitor. Includes the worked example of a handover after which the customer ran the detection for six months without a single clarification ticket.

Module 9. Working with product on what to ship next

The detections you write expose product gaps the customer cares about. This module walks the feedback loop into the product team: packaging a recurring customer ask as a product requirement, the evidence a product manager needs to prioritise it, phrasing the request so engineering does not treat it as a one-off, and the cadence for closing the loop. Includes the worked example of a parent-process visibility request that became a product feature in two quarters.

Module 10. The cross-customer threat hunt campaign

Some threats are worth hunting across the account book at once. This module walks the campaign: choosing the threat (a named APT group, a CVE under active exploitation, a sector-specific intrusion pattern), authoring the cross-customer hunt, coordinating with sales engineering on the customer outreach, and reporting the aggregated findings without disclosing one customer's data to another. Includes the worked example of a coordinated ProxyShell hunt across a regional book.

Module 11. Evidence the customer's auditor will accept

Customer auditors increasingly ask for evidence that specific detections cover specific controls. This module walks the evidence package: the mapping from authored detections to the customer's control framework (ISO 27001 Annex A, NIST CSF, internal control libraries), the artefacts the auditor will request, and presenting the package so the customer's compliance team does not have to translate it. Includes the worked example of a SOC 2 audit where the vendor-supplied evidence shortened the cycle.

Module 12. The quarterly business review you actually want to run

The vendor QBR is usually a sales call. This module walks the version a detection engineering specialist owns: the customer outcomes since last quarter (detections shipped, threats hunted, false-positives reduced), the coverage delta closed, the product asks moving forward, and the single artefact the customer's CISO takes into the board. Includes the worked example of a QBR after which the customer expanded the contract because the technical outcomes were undeniable.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

A customer SOC manager pings you about a detection that fired late: modules 1, 3, 4.

A customer CISO asks which ATT&CK techniques are covered against a named APT: modules 2, 5, 11.

A customer auditor asks which detections evidence which control: modules 4, 11, 12.

A product manager asks why three customers are asking for the same telemetry: modules 9, 10.

What you get with this course

12 written modules with worked examples drawn from vendor-side detection engineering practice.
Downloadable telemetry profile template, ATT&CK coverage map template, tuning rationale doc template, hunt package template, and detection library schema.
Cross-platform detection authoring reference card (SPL, KQL, EQL variants of the same logic).
Hand-built implementation playbook tuned to your account book and product, delivered alongside course access.
30-day money-back guarantee if the practice does not change how your customer SOC reviews look.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours, your account in the Art of Service learning environment is provisioned and the hand-built implementation playbook is delivered alongside it.

Modules 1 to 4 cover the intake and authoring foundation, runnable in the first week.

Modules 5 to 8 build the customer-facing motion (hunt packages, review meetings, handover discipline) over the following two weeks.

Modules 9 to 12 establish the cross-customer practice (product feedback loop, coordinated hunts, audit evidence, QBR) over the final two weeks.

Implementation playbook is referenced throughout and is the artefact you keep using after the course is finished.

Before and after

Before

Writing one-off detections per customer, rebuilding the same correlation logic across three SIEM stacks, and walking into the customer SOC review with a status update rather than an authored output.

After

Running a vendor-side detection engineering practice with a reusable internal library, shipping authored detections with documented tuning rationales, and walking into the customer SOC review with a coverage delta, a hunt package and a product ask the customer expects you to bring.

What happens if you do not address this

The customer SOC keeps asking why your tool missed things. Each one-off detection adds technical debt nobody else on your side can maintain. The customer's CISO eventually asks a competitor to demo their detection engineering motion because yours never moved past per-account firefighting.

Who it is for

A vendor-side cybersecurity specialist embedded with customer SOC teams. Spends the day in customer detection reviews, threat-intel handoffs, XDR tuning calls, and the cross-team conversation between sales engineering and product about what to ship next. Has technical depth in EDR, SIEM correlation, ATT&CK mapping and threat-intel pivoting. Is measured on customer retention, expansion within the account, and how often the customer's SOC quotes the specialist's detections back to them in a quarterly review.

Who this is NOT for. Not for internal-only SOC analysts who never face an external customer. Not for product managers who do not author detections themselves. Not for sales engineers who own pre-sale demos but not post-sale tuning. Not for managed-detection-and-response analysts who run the customer's SOC end-to-end as a service rather than authoring detections handed back to the customer's own team.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 12 to 16 hours across the 12 modules. Most specialists run it across four working weeks, applying each module to a live customer account as they go.

Why $199 is the right number

A SANS detection engineering course is excellent foundation work but assumes an internal SOC seat and does not address the vendor-side customer conversation. A vendor-internal enablement deck covers product features but does not give you a repeatable customer-facing practice. Public ATT&CK resources are free and worth reading, but they do not walk the handover into the customer's SIEM, the tuning rationale doc the customer's CISO forwards, or the cross-customer hunt campaign. This course is built for the specific seat between vendor product, vendor threat intel, and the customer's SOC.

FAQ

Does this teach the Trend Vision One product?

No. The course is product-neutral. It teaches a detection engineering practice you can run regardless of which XDR or SIEM stack the customer is on. Worked examples reference the kind of telemetry and correlation logic any major endpoint and XDR product produces.

I already author detections for customers. What is new here?

The course is about the practice around the detection, not the syntax of the detection itself. The tuning rationale document, the cross-customer hunt campaign, the detection library schema, the evidence package for the customer's auditor, the QBR a specialist owns. These are the artefacts most vendor-side specialists end up improvising and that fail to scale.

Will I get the implementation playbook before I finish the course?

Yes. The hand-built implementation playbook is delivered alongside course access within 24 hours of purchase. You can read it before module 1 and use it as the running reference while you work through the modules.

What if the practice does not fit my account book?

30-day money-back guarantee. If after working through the modules and the playbook the practice does not change how your customer SOC reviews look, request a refund and you receive one without questions.

Is there a cohort or live element?

No. Self-paced written course plus the implementation playbook. The reason there is no live element is so you can run the course on your own customer review schedule, not on a cohort calendar.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.