Build a lab with a Windows VM, Sysmon and a free SIEM such as Wazuh or Elastic, then run five Atomic Red Team tests and find each in the logs.
Write Sigma rules for two of those tests and convert them to your SIEM's query language.
Done when you can…
Show a rule that fires on a simulated attack and not on a day of normal use.
Explain why a behaviour-based rule beats a hash-based one.
Beginner
Log sources and telemetry
You can only detect what you collect. Learn which logs show process starts, logons, network connections, cloud API calls and email, and what each misses.
ATT&CK describes attacker behaviour technique by technique, with data sources for each. Use it to decide what to detect and to describe what a rule covers.
Each rule needs a goal, the technique it covers, blind spots, false positives and a response guide. The Alerting and Detection Strategy framework is a good template.
Baselines of normal behaviour per user or host catch what fixed rules miss, such as a first-time admin logon. Combine them with rules to keep alerts precise.
Parsing, normalising and routing logs decides what detections can see and what it costs. Learn a common schema such as the Elastic Common Schema or OCSF.
Attackers rename tools and change command lines. Focus on what they cannot easily change, such as the underlying API calls or relationships between events.
Detection engineers write the rules and analytics that turn raw logs into alerts. They decide which data to collect, which attacker behaviours to look for, and how to tell an attack from normal work.
Modern teams treat detections as code: written in a common format such as Sigma, stored in version control, reviewed, tested against real attack data and measured for quality. The aim is fewer, better alerts that catch real attacks.
Why it matters
A SOC is only as good as its detections. Noisy rules burn out analysts, and missing ones let attackers stay for months. Detection engineering is one of the fastest-growing blue team roles.
Typical job roles
EntrySOC analyst tuning rulesReports noisy rules, suggests fixes and writes first simple detections.
Mid-levelDetection engineerBuilds, tests and maintains detections across endpoint, network, identity and cloud.
Mid-levelSecurity data engineerBuilds the log pipelines, parsing and data models that detections need.
SeniorSenior detection engineerLeads coverage strategy, testing and detection-as-code tooling.
LeadHead of detection and responseOwns detection strategy, coverage and quality metrics for the organisation.
Prerequisites
Security Operations beginner and intermediate stages.
Windows and Linux logging basics: event logs, Sysmon, syslog, auditd.
MITRE ATT&CKA knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
MITRE D3FENDA knowledge graph of defensive techniques, mapped to the ATT&CK techniques they counter.
NIST Cybersecurity Framework (CSF) 2.0A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
CIS Critical Security ControlsA prioritised list of 18 practical defences, grouped so smaller organisations know what to do first.
MITRE EngageA framework for adversary engagement: deception, denial and learning from attackers on purpose.