Detection Engineering: Defending Networks with Purpose
summary
A practical detection‑engineering recipe that templates threats, measures coverage, and engineers alerts: a test lab runs Security Onion 2 with Wazuh, Sysmon and Playbook (Sigma rules) and invokes tactics from Atomic Red Team via PowerShell. About 68 tests run; default Zeek/Circa alerts give ~61.36% coverage and event data for the rest, and enabling Sigma rules raises alerts toward 100% at the cost of noise. Demo shows batch‑file execution detected and a repeatable process for closing gaps.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:45Philosophy of Detection
- 1:05Engineering Detections
- 14:07Live Demo: Wargaming
- 19:17Closing the Gaps
- 21:20Demo Review
- 22:28Summary and Conclusion
- 25:40Q&A Session
related talks
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
35mThe Best Defense is a Great Offense: Leveraging Automated...
45mAdvanced Security Operations with Elastic Security
29mDetection Engineering in Kubernetes Environments: Wrangling Security Data Out of You...
49mLessons from DevSecOps Trenches
24mDetect known unknowns
30mDetection as Code: Detection Development Using CI/CD
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks