Detection Engineering and Incident Response Capstone
Deliver a complete detection and incident package from the synthetic course data, then compare the result with a detailed answer key and scoring rubric.
Detection-Engineering-Incident-Response-Courses
Detection Engineering and Incident Response Quiz
Test telemetry, ATT&CK mapping, detection logic, triage, scoping, containment, recovery, and evidence handling with a complete answer key.
Detection Engineering Lesson 1: Telemetry and Evidence
Inventory identity, endpoint, and DNS telemetry. Normalize timestamps, preserve source events, and document evidence limits before analysis.
Detection Engineering Lesson 2: ATT&CK Detection Strategies
Use current MITRE ATT&CK Detection Strategies and Analytics to describe behavior, telemetry needs, and platform logic without treating a mapping as proof.
Detection Engineering Lesson 3: Detection Hypotheses and Rules
Turn a behavior hypothesis into portable detection logic, positive and negative tests, tuning criteria, and an operational runbook.
Incident Response Lesson 4: Triage and Scoping
Triage an alert, separate severity from confidence, search related identity and endpoint activity, and write a bounded incident scope statement.
Incident Response Lesson 5: Full Investigation Lab
Investigate a synthetic identity and endpoint compromise from raw JSONL and CSV evidence. Build a timeline, scope statement, findings, and search plan.
Incident Response Lesson 6: Containment and Recovery
Plan evidence-aware containment, credential and token response, endpoint recovery, service restoration, communication, and detection improvements.
