Detection Engineering for Beginners

This course teaches the theory behind security operations and detection engineering. We’ll then start building out our home lab using VirtualBox and Elastic’s security offering. Then we’ll run through three different attack scenarios, each more complex than the one prior. We’ll make detections off of our attacks, and learn how to document our detections. Next we’ll dive more into coding and Python by writing validation scripts and learning out to interact with Elastic through their API. Wrapping everything up, we’ll host all our detections on GitHub and sync with Elastic through our own GitHub Action automations. As a cherry on top, we’ll have a final section on how to write scripts to gather important metrics and visualizations.

This course takes students from A-Z on the detection engineering lifecycle and technical implementation of a detection engineering architecture.

While this course is marketed as entry level, any prerequisite knowledge will help in the courses learning curve. Familiarity with security operations, searching logs, security analysis, or any related skillset will be helpful (but ultimately not required).

The ability to run 2-3 VMs on a local machine:

* Ubuntu Linux

* ParrotOS

* Windows 11

Minimum Requirements:

CPU Cores: 4

RAM: 8GB

Hard Drive Space: 50GB

Recommended Requirements:

CPU Cores: 6+

RAM: 16GB+

Hard Drive Space: 50GB+

You can technically get by with the main host having only a couple cores and 8 gigs of RAM, but any additional resources that can be assigned to your VMs will make the process smoother.

• Introduction
  • Welcome!
• Theory
  • Security Operations
  • Role Variety
  • Security Incident and Event Management
  • The Detection Engineering Workflow
  • What Makes a Good Detection
  • Technology Stack for Detection Engineering
  • MITRE ATT&CK Framework
  • Navigating the MITRE ATT&CK Matrix
• Lab Setup
  • Lab Overview
  • File Downloads
  • Importing ParrotOS into VirtualBox
  • Importing Windows 11 into VirtualBox
  • Ubuntu VirtualBox Installation
  • Creating a VM Snapshot
  • Disabling Windows Defender
  • Installing Zeek
• Elastic Setup
  • Elastic Overview
  • Signing Up for Elastic Trial
  • Trial Extending and New Trials
  • Elastic Agent Installation
  • Confirming Zeek Logging With NMAP
  • Testing Windows Elastic Agent Logging with EICAR File and PowerShell
  • Sysmon Overview
  • Installing and Configuring Sysmon
  • Testing Sysmon Logging with EICAR File and PowerShell
  • Improving Our PowerShell Visibility
• Attack Scenario 1
  • Attack Overview
  • Setting up the Attack
  • Performing the Attack
  • Creating our first Query Alert
  • Creating our first Threshold Alert
  • Alert Confirmation
• Attack Scenario 2
  • Overview
  • Creating and Executing Attack – Part 1
  • Creating and Executing Attack – Part 2
  • Reviewing the Attack
  • Creating Alerts
  • Confirming our Detections
• Attack Scenario 3
  • Overview
  • Staging our Attack
  • Creating and Executing our Attack
  • Creating our Detections
  • Confirming our Detections
• Atomic Red Team
  • Atomic Red Team Introduction
  • Installation
  • Running our First Atomic
  • Writing our First Atomic
• TOML
  • TOML Overview
  • Setting up a Development Environment
  • Reviewing Elastic Rule TOML
  • Working with the Elastic Detection Rules Repo
  • Validating TOML Syntax Using Taplo
  • Creating an Elastic TOML Template
  • Enforcing TOML Required Fields
  • Creating a MITRE Object in Python
  • Working with Multiple TOML Files
  • Validating MITRE Data in our TOML – Part 1
  • Validating MITRE Data in our TOML – Part 2
  • Converting and Validating our Detections
• Elastic API
  • Introduction
  • Obtaining your API Key
  • Pushing a Sample Rule
  • Writing a TOML to JSON Script
  • GET-ing Our First Rule and Managing Rule IDs
  • Working with our Custom Detections
  • Updating our Custom Detections
• GitHub
  • Overview
  • GitHub Actions Introduction
  • Uploading our Detections and Code
  • Creating our TOML Validation Action
  • Enforcing Validation Checks
  • Syncing with Elastic – Part 1
  • Syncing with Elastic – Part 2
• Metrics
  • Overview
  • Converting our TOML to CSV
  • Converting TOML to MD
  • Converting our TOML to Att&ck Navigator .JSON
  • Creating our Metrics GitHub Action
  • Creating Status Badges
• Conclusion
  • Farewell