Udemy
    •  
    •  
    •  
    •  
    •  
    •  
    •  
    •  
Turn what you know into an opportunity and reach millions around the world.
Learn More
Your cart is empty.
Keep shopping
Detection Engineering Masterclass: Part 2
Rating: 4.7 out of 5(15 ratings)
538 students

Detection Engineering Masterclass: Part 2

Detection Engineering Zero to Hero
Last updated 7/2023
English

What you'll learn

  • Understand how to write detection documentation
  • Ability to automate document validation
  • Learn GitHub actions to validate documents automatically
  • Write Python scripts to sync up the detection library with the SIEM
  • Write Python scripts to create metrics

Course content

5 sections33 lectures5h 29m total length
  • TOML Overview6:20
  • Setting up a Development Environment4:01
  • Reviewing Elastic Rule TOML4:33
  • Working with the Elastic Detection Rules Repo7:58
  • Validating TOML Syntax Using Taplo6:28
  • Creating an Elastic TOML Template8:40
  • Enforcing TOML Required Fields17:48
  • Working with Multiple TOML Files10:41
  • Creating a MITRE Object in Python28:07
  • Validating MITRE Data in our TOML - Part 114:39
  • Validating MITRE Data in our TOML - Part 214:39
  • Converting and Validating our Detections6:59

Requirements

  • Completion of "Detection Engineering Masterclass: Part 1"
  • Basic understanding of Python

Description

Welcome to the Detection Engineering Masterclass: Part 2!


Don't Purchase if you haven't gone through Part 1!


Two Part Course Overview

This course will first teach the theory behind security operations and detection engineering. We’ll then start building out our home lab using VirtualBox and Elastic’s security offering. Then we’ll run through three different attack scenarios, each more complex than the one prior. We’ll make detections off of our attacks, and learn how to document our detections. Next we’ll dive more into coding and Python by writing validation scripts and learning out to interact with Elastic through their API. Wrapping everything up, we’ll host all our detections on GitHub and sync with Elastic through our own GitHub Action automations. As a cherry on top, we’ll have a final section on how to write scripts to gather important metrics and visualizations.


This course takes students from A-Z on the detection engineering lifecycle and technical implementation of a detection engineering architecture.


While this course is marketed as entry level, any prerequisite knowledge will help in the courses learning curve. Familiarity with security operations, searching logs, security analysis, or any related skillset will be helpful (but ultimately not required).


Part Two Overview

This is part two of a two part series on Detection Engineering! This course is meant to kickstart anyone interested in security analysis, detection engineering, and security architecture.


The first part is the meat of the course, where we will go over:

  1. Detection Engineering Theory

  2. Setting Up our Lab

  3. Working with Logging and our SIEM

  4. Running Attack Scenarios to generate logs and create alerts

  5. Learn how to use Atomic Red Team for testing


The second part deals with detection as code philosophies, which will be very Python and GitHub heavy (but don't worry! I'll walk you through everything step by step.)


By the end of this two part course, you'll have a full stack detection engineering architecture. You'll be able to:

  1. Run offensive tests

  2. Review the logs

  3. Make alerts

  4. Save alerts using a standardized template

  5. Enforce template data through code

  6. Programmatically push the alerts to the SIEM

  7. Run periodic metrics off the detection data


The entire course runs ~11 or so hours in length, but should take ~20-40 hours to complete fully. All code written will be available on the course GitHub in case you'd like to skip the Python heavy sections.


Requirements

The ability to run 2-3 VMs on a local machine:

  • Ubuntu Linux

  • ParrotOS

  • Windows 11


Minimum Requirements

CPU Cores: 4

RAM: 8gb

Hard Drive Space: 50GB


Recommended Requirements

CPU Cores: 6+

RAM: 16GB+

Hard Drive Space: 50GB+


You can technically get by with the main host having only a couple cores and 8 gigs of RAM, but any additional resources that can be assigned to your VMs will make the process smoother.


Thanks for stopping by!

Who this course is for:

  • security analysts
  • incident responders
  • detection engineers
  • cyber security college students