SOC105 · Detection Engineering with SIEM Tools

Categories: Cybersecurity
Wishlist Share

About Course

Design, write, test and tune detection rules as code. You use Sigma to write portable detections, convert them for a SIEM, and run them through a repeatable testing and tuning process.

Advance · 8 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

Analysts and security engineers responsible for the quality of alerts in a SIEM.

Prerequisites

Complete SOC103 and SOC104, or have hands-on experience with SIEM searches and ATT&CK mapping.

What you will be able to do

  • Write a detection specification that defines goal, data source, logic, false-positive sources and response
  • Author Sigma rules and convert them with sigma-cli for Elasticsearch or another SIEM backend
  • Test detections against known-good and known-bad sample events and record results
  • Tune rules using precision, alert volume and analyst feedback without creating blind spots

Lessons

  • Lesson 1 · Detection engineering as a discipline
  • Lesson 2 · Writing portable rules with Sigma
  • Lesson 3 · Testing, tuning and measuring detections
  • Lesson 4 · Lab and assignment

Lab: Build and test three Sigma detections

You write three Sigma rules for behaviors from your SOC104 gap analysis, convert them with sigma-cli to Elasticsearch queries, and run them in Kibana against sample Windows events you generate yourself. You store the rules, test notes and results in a Git repository, following a simple detection-as-code workflow.

Free tools: Elastic Stack free basic tier in Docker Desktop (or the Wazuh lab from SOC103), sigma-cli (pySigma, free), VS Code and a GitHub free repository

Assessed assignment

Deliver a detection pack of three production-ready rules for a small professional-services firm. For each rule, provide the detection specification, the Sigma YAML, the converted query, test evidence (true-positive and false-positive cases), expected alert volume and a short triage guide. Explain one tuning decision you made and the residual risk it creates.

Criterion Weight What excellent work looks like
Detection specifications 25% Each rule has a clear goal, ATT&CK mapping, data source, logic, known false positives and response steps.
Rule quality 30% Sigma rules are valid, convert without errors and target behavior rather than brittle indicators.
Testing evidence 25% Both positive and negative test cases are documented with screenshots or query output.
Tuning and triage 20% Tuning is justified, residual risk is stated and the triage guide is usable by a Tier 1 analyst.

Portfolio piece

A Git repository with a tested three-rule Sigma detection pack and triage guides.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

Continue with SOC106 · Vulnerability Management and Patching · 8 hours · $56.00

Continue to the next course

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Write a detection specification that defines goal, data source, logic, false-positive sources and response
  • Author Sigma rules and convert them with sigma-cli for Elasticsearch or another SIEM backend
  • Test detections against known-good and known-bad sample events and record results
  • Tune rules using precision, alert volume and analyst feedback without creating blind spots

Course Content

SOC105 · Detection Engineering with SIEM Tools (8 h)
Design, write, test and tune detection rules as code. You use Sigma to write portable detections, convert them for a SIEM, and run them through a repeatable testing and tuning process.

  • Lesson 1 · Detection engineering as a discipline
  • Lesson 2 · Writing portable rules with Sigma
  • Lesson 3 · Testing, tuning and measuring detections
  • Lesson 4 · Lab and assignment
  • SOC105 Assessment · Detection Engineering with SIEM Tools
Scroll to Top