Detection Engineering

A SOC analyst who has worked an incident knows what *should* have been caught. Detection engineering is the discipline of turning that knowledge into detection content a team can maintain, measure and retire — not a rule typed into a console and forgotten, but code with tests, review, coverage and a change history. You work on `soc01`, an Ubuntu 24.04 machine that carries the SOC analyst toolkit (auditd, fail2ban, nginx and the ULC-006 synthetic generator) plus a single-node **Wazuh manager**, the **Sigma** detection-as-code toolchain (`sigma-cli`, pySigma and a SQLite backend), and an offline copy of the MITRE ATT&CK and D3FEND data. Everything you investigate is **synthetic**, generated on your own machine from documentation-range addresses; no production log, no customer data and no live target is ever involved. Across ten lessons you learn the detection lifecycle; how to normalise three disagreeing log families into one queryable event stream; how to write a Sigma rule whose logsource, detection, condition, level, tags and false positives pass `sigma check`; how to convert rules to queries with a processing pipeline and see exactly what your backend does and does not support; how to test a rule so it fires on the behaviour and stays silent on a clean day; how to measure and tune false positives with a written rationale; how to keep rules as code with stable ids, an ATT&CK coverage matrix, a peer-review checklist and a fail-closed CI gate; and how to run the same detections continuously on a host and on a Wazuh manager, promoting a rule through a change record with a rollback. The final project hands you an unseen incident bundle and asks for a complete detection pack — rules, pipeline, tests, a false-positive report, a coverage matrix, a passing CI gate and a rollout note — graded against a rubric and automated lab checks that run your rules against held-back synthetic samples.