Network detection engineering
You manage network detections as code, map them to ATT&CK, test them automatically with PCAPs, wire them into CI and measure alert quality.
Level 401 · 15 lessons · 12 practice labs
Lessons
Designing a detection
- The detection lifecycle: idea, research, writing, testing, release
- Mapping detections to MITRE ATT&CK techniques
- Data source coverage: what each sensor can see
- The detection spec: purpose, logic, false positives, response
- Short task: write a detection spec for DNS tunnelling
Detection as code
- Detection repository layout: rules, test PCAPs, docs
- PCAP-based unit tests: expected and unexpected alerts
- Validating and deploying rules in continuous integration
- Staged rollout: log-only first, then alert
- Short task: submit a rule with a failing test and show CI blocking it
Measuring and improving
- Alert quality metrics: precision, volume, time to respond
- Tuning rules with analyst feedback
- Validating coverage with test traffic in the lab
- Preparing a coverage report and gap list
- Capstone: ship five network detections with tests and documentation
Practice labs
- Fill in a detection document template: Fill in the purpose, logic, false positive and response headings for a ready-made rule.
- A detection document for DNS tunnelling: Write a page documenting a DNS tunnelling detection with data source, threshold and known false positives.
- Carry an idea through to release: Take one detection idea through every lifecycle step with a research note, rule, test capture and document.
- Map rules to ATT&CK techniques: Match ten network rules to the relevant MITRE ATT&CK technique.
- Which sensor sees what: Write the traffic types that border, core and edge sensors cannot see into a coverage table.
- A coverage report and gap list: Map the existing rule set against techniques and report five uncovered techniques in priority order.
- Lay out a detection repository: Place rules, test PCAPs and documents in separate folders and write the naming convention.
- Write a PCAP-based unit test: Write a test script verifying expected and unexpected alerts for one rule.
- Let CI stop a failing test: Show a rule submitted with a failing test being stopped in the continuous integration pipeline, then fix it and pass.
- Calculate alert quality metrics: Calculate volume and precision per rule from a week of alert export.
- Tune a rule with analyst feedback: Find the common trait of twenty alerts closed as false positives and add an exception to the rule.
- A staged rollout plan: Run a new rule in log-only mode first and justify the decision to promote it to alerting from a day of results.
About this course
You manage network detections as code, map them to ATT&CK, test them automatically with PCAPs, wire them into CI and measure alert quality.
What you will learn
- Designing a detection
- Detection as code
- Measuring and improving
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.