MODULE 1
Choose the Simplest Claim the Evidence Can Support
See why analytic complexity should follow the behavior rather than compensate for weak evidence.
FREE COURSE / SELF-PACED LEARNING
Reasoning with Detection Analytics
Compare matches, thresholds, sequences, graphs and baselines in this free course on making defensible detection claims.
Read freely. Create an account to save your completed lessons.
- Experience level
- Advanced
- Curriculum
- 3 modules · 3 lessons
- Estimated reading
- 12 min
- Language
- English
Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.
KNOW WHAT YOU’RE WORKING TOWARD
What you’ll learn
- Compare matches, thresholds and sequences by the claim each can support.
- Explain how baseline changes, graph relationships and risk scores can mislead an investigation.
Is this the right course for you?
Who it’s for
Analysts choosing an analytical approach for an explicit detection question.
Scope and boundaries
The claims and limitations of analytical forms. This course is not a statistical programming or machine-learning implementation course.
How you’ll learn
Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.
Before you begin
- Detection Engineering: From Telemetry to Tuned Detections — You should understand the basic detection lifecycle and common telemetry sources.
About this course
Understand what matches, thresholds, sequences, graphs, baselines, and risk scores actually claim—and where each form can mislead you. The course is written for one reader and develops its ideas through continuous explanation, realistic thought experiments, and explicit distinctions between fact, assessment, and uncertainty.
TRY THE REASONING / FICTIONAL SCENARIO
A threshold crossed during a planned migration
An account downloaded 4 GB in an hour, crossing a 1 GB threshold. The same hour contains an approved migration, but the alert does not identify which files were accessed.
Your task
Separate the threshold result from the exfiltration hypothesis. Name evidence that could distinguish approved work from unrelated access.
Compare your reasoning
The threshold proves that the measured quantity exceeded the rule's boundary. It does not establish unauthorized disclosure. Compare the job identity, file scope, destination and migration window with the approved task. A changed workload can invalidate a historical baseline; an approved job does not automatically explain every transfer in the same hour.
This example is a reflection exercise, not a scored assessment.
FOLLOW THE LEARNING PATH
Course curriculum
MODULE 2
Use Sequences and Graphs Without Inventing Causality
Model ordered behavior and entity relationships while resisting unsafe joins and compelling but false stories.
MODULE 3
Treat Baselines and Risk Scores as Arguments
Understand drift, calibration, double-counting, and the difference between a score and a conclusion.
BUILD ON THE RIGHT FOUNDATION
Related learning paths
These courses address different scopes. Choose the foundation or follow-on that fits your next question.
Sources and editorial review
Reviewed by Threat Intelligence Lab
Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.
Selected references are shown here; the lessons contain the full reading lists.
About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.