MODULE 1
Portable Rules Preserve Intent, Not Identical Behavior
Understand rule structure and portability without assuming that one document behaves identically everywhere.
FREE COURSE / SELF-PACED LEARNING
Portable Detection Content and Its Delivery
Understand portable detection intent, Sigma translation, correlation and tested delivery with this free detection-as-code course.
Read freely. Create an account to save your completed lessons.
- Experience level
- Advanced
- Curriculum
- 3 modules · 3 lessons
- Estimated reading
- 10 min
- Language
- English
Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.
KNOW WHAT YOU’RE WORKING TOWARD
What you’ll learn
- Identify field and semantic assumptions that can change a translated Sigma rule.
- Explain how tests and deployment evidence connect portable intent to runtime behavior.
Is this the right course for you?
Who it’s for
Practitioners moving detection logic between platforms or into controlled delivery workflows.
Scope and boundaries
Portability and delivery reasoning. Backend behavior and local field mappings still require platform-specific tests.
How you’ll learn
Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.
Before you begin
- Detection Engineering: From Telemetry to Tuned Detections — You should understand the basic detection lifecycle and common telemetry sources.
About this course
Learn how Sigma expresses portable intent and how detection-as-code turns that intent into reviewed, tested, traceable runtime content. The course is written for one reader and develops its ideas through continuous explanation, realistic thought experiments, and explicit distinctions between fact, assessment, and uncertainty.
TRY THE REASONING / FICTIONAL SCENARIO
One rule, two incompatible field meanings
A portable rule checks a parent-process field. Backend A records the immediate parent; Backend B supplies a reconstructed ancestor. Both translations execute successfully.
Your task
Explain why successful execution is insufficient and propose a test that exposes the semantic difference.
Compare your reasoning
The backends answer different relationship questions. A query that runs can still broaden or narrow the original detection intent. Use synthetic fixtures with a grandparent that matches and an immediate parent that does not. Record expected outcomes for each mapping, then either adapt the rule deliberately or state that the backend cannot preserve this claim.
This example is a reflection exercise, not a scored assessment.
FOLLOW THE LEARNING PATH
Course curriculum
MODULE 2
Correlation and Filters Add State and Local Policy
Understand Sigma 2.1 correlation forms and reusable filters together with their timing and tuning assumptions.
MODULE 3
Detection-as-Code Is a Chain of Evidence
Use versioning, tests, provenance, staged deployment, and retirement to keep content trustworthy through change.
BUILD ON THE RIGHT FOUNDATION
Related learning paths
These courses address different scopes. Choose the foundation or follow-on that fits your next question.
Sources and editorial review
Reviewed by Threat Intelligence Lab
Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.
Selected references are shown here; the lessons contain the full reading lists.
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.