MODULE 1
Evidence Is Not the Same as a Conclusion
Separate observed activity from interpretation, alerting, incident judgment, and response authority.
FREE COURSE / SELF-PACED LEARNING
Detection Engineering as a Way of Reasoning
Turn a threat concern into a testable hypothesis and an honest coverage claim in this free detection engineering course.
Read freely. Create an account to save your completed lessons.
- Experience level
- Intermediate
- Curriculum
- 3 modules · 3 lessons
- Estimated reading
- 12 min
- Language
- English
Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.
KNOW WHAT YOU’RE WORKING TOWARD
What you’ll learn
- Distinguish an observed record from an inference about hostile behavior.
- Write a detection hypothesis with required evidence and an explicit coverage boundary.
Is this the right course for you?
Who it’s for
Learners who know basic security concepts and want a clear detection reasoning method.
Scope and boundaries
A conceptual starting point for the specialist detection series. It focuses on requirements and claims before platform-specific rule writing.
How you’ll learn
Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.
Before you begin
- Detection Engineering: From Telemetry to Tuned Detections — You should understand the basic detection lifecycle and common telemetry sources.
About this course
Learn how detection engineers move from an uncertain security concern to a bounded, testable claim without confusing data, framework mappings, or alerts with proof. The course is written for one reader and develops its ideas through continuous explanation, realistic thought experiments, and explicit distinctions between fact, assessment, and uncertainty.
TRY THE REASONING / FICTIONAL SCENARIO
An alert is not an incident
A rule matched an administrator's remote session at 02:00. The record names the account and host, but no change ticket or user confirmation is available.
Your task
Write an observation, a competing explanation and the next evidence request. State one conclusion you cannot yet support.
Compare your reasoning
The observed fact is a remote session recorded under the named account. Maintenance and unauthorized use remain competing explanations. Request the approved maintenance schedule and independently verify the account owner; do not label the session malicious solely because it occurred at night. A rule match establishes its conditions, not the complete incident narrative.
This example is a reflection exercise, not a scored assessment.
FOLLOW THE LEARNING PATH
Course curriculum
MODULE 2
Turn a Threat Concern into a Detection Hypothesis
Decompose behavior, identify invariants, and write a hypothesis that evidence can support or contradict.
MODULE 3
Write Requirements and Make Honest Coverage Claims
Define the consumer, evidence, timing, tests, and limits before claiming that a behavior is covered.
BUILD ON THE RIGHT FOUNDATION
Related learning paths
These courses address different scopes. Choose the foundation or follow-on that fits your next question.
Sources and editorial review
Reviewed by Threat Intelligence Lab
Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.
Selected references are shown here; the lessons contain the full reading lists.
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.