Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

Coursera

Practical Threat Detection Engineering

Packt via Coursera

Go to class Write review

Overview

Google, IBM & Meta Certificates – 40% Off
One Coursera Plus subscription covers most Professional Certificates on Coursera.
Unlock All Certificates
Master detection engineering with this hands-on guide. Learn to build, test, and optimize security detections using real-world scenarios, open-source tools, and industry frameworks like MITRE ATT&CK. This course provides a practical foundation in detection engineering, helping learners build, test, and refine security detections to strengthen organizational defenses. It covers the full detection lifecycle with real-world examples and actionable frameworks. Designed for professionals looking to advance their cybersecurity skills, it emphasizes both technical and strategic aspects of detection validation. This course is ideal for SOC analysts, threat hunters, and security engineers looking to enhance their detection capabilities. No prior experience in detection engineering is required, but a basic understanding of cybersecurity concepts is recommended. This book takes a practical, hands-on approach to detection engineering, guiding you from foundations to implementation with real-world scenarios and labs. It helps you build, test, and validate detections, ensuring you're job-ready. By aligning with industry frameworks like MITRE ATT&CK and leveraging open-source tools, it equips you with the skills needed to excel in your career. This course is based on Practical Threat Detection Engineering, by Megan Roddie, Jason Deyalsingh and Gary J. Katz. Packt is one of the world's most prolific publishers of cutting-edge technical content. For over two decades we've made it our mission to curate and publish the knowledge of only the very best technical experts. We focus on real-world courses that help our customers get the job done, with coverage that extends across a wide range of established and cutting-edge technical topics. If you're an individual or an organisation that embraces learning by doing, Packt is the perfect fit for you.

Syllabus

  • Fundamentals of Detection Engineering
    • This module provides an overview of detection engineering, covering key concepts such as attack frameworks, detection strategies, and models like the MITRE ATT&CK Framework and the Pyramid of Pain. Learners will gain insight into the importance of early threat detection and how to justify detection programs to stakeholders. The content equips students with foundational knowledge to understand and implement effective security detection practices.
  • The Detection Engineering Life Cycle
    • This module provides a comprehensive overview of the detection engineering life cycle, covering phases such as investigation, development, monitoring, and the role of threat intelligence. Learners will gain insights into how to align detection strategies with organizational needs and improve threat response effectiveness.
  • Building a Detection Engineering Test Lab
    • This module guides learners through setting up a detection engineering test lab using the Elastic Stack. It covers deploying Docker, configuring the Elastic Stack, and implementing detection rules for threat monitoring. Learners will gain hands-on experience in building and managing a secure, scalable lab environment.
  • Detection Data Sources
    • This module covers the importance of detection data sources and how to enhance lab environments with telemetry for better threat detection. Learners will explore various data sources, including Windows Event Logs, network telemetry, application logs, and SIEM systems. The module also addresses challenges in data collection and provides practical steps for adding and configuring data sources.
  • Investigating Detection Requirements
    • This module guides learners through the process of identifying, prioritizing, and implementing detection requirements within an organization. It covers methods for analyzing data sources, leveraging productivity tools, and assessing detection coverage to optimize security efforts. Learners will gain practical skills in structuring detection strategies based on threat severity and organizational needs.
  • Developing Detections Using Indicators of Compromise
    • This module provides learners with hands-on experience in developing static indicator-based detections using the detection engineering life cycle. It covers identifying indicators of compromise, analyzing network and system data, and implementing detection strategies using tools like Sysmon.
  • Developing Detections Using Behavioral Indicators
    • This module covers the process of building effective security detections using behavioral indicators rather than traditional threat intelligence. Learners will gain skills in configuring data sources, understanding adversary tools, and implementing detection rules in the Elastic Stack for real-world threat identification.
  • Documentation and Detection Pipelines
    • This module covers the creation and management of detection documentation, the implementation of detection-as-code, and the deployment of detection pipelines to ensure efficient and consistent security operations. Learners will gain hands-on skills in documenting detections, using detection tools, and setting up automated pipelines for rule management and validation.
  • Detection Validation
    • This module covers techniques for validating security detections through simulated adversary activities. Learners will gain hands-on experience with tools like Caldera and Atomic Red Team to test and improve security operations. The focus is on understanding how to measure and enhance detection coverage in real-world scenarios.
  • Leveraging Threat Intelligence
    • This module explores how threat intelligence is integrated into detection engineering, focusing on its role in requirements discovery, triage, and investigations. Learners will understand how threat assessments shape detection strategies and how to use tools like VirusTotal for threat analysis. The module provides practical knowledge on leveraging internal and external threat intelligence sources.
  • Performance Management
    • This module explores the principles and metrics used to assess the efficiency and effectiveness of detection engineering programs. It covers key concepts such as velocity, validation coverage, precision, recall, and ROC curves, providing learners with tools to measure and improve cybersecurity performance. By the end, students will understand how to evaluate and optimize detection strategies.
  • Career Guidance for Detection Engineers
    • This module provides insights into the career path of a detection engineer, covering job opportunities, skill development, and industry trends. It also discusses training options, community involvement, and the evolving role of detection engineering in the future of cybersecurity.

Taught by

Packt - Course Instructors

Reviews

Start your review of Practical Threat Detection Engineering

Go to class

Never Stop Learning.

Get personalized course recommendations, track subjects and courses with reminders, and more.

Sign up for free
Someone learning on their laptop while sitting on the floor.