Build mapped, testable detections, author Sigma rules, close coverage gaps, and reduce false positives
Identify the minimum telemetry and evidence quality needed to support a given MITRE ATT&CK technique.
Translate a scoped detection hypothesis, including behavior and exclusions, into testable rule logic.
Analyze Sigma log sources, selections, conditions, fields, and false-positive notes in relation to ATT&CK mapping.
Produce a complete Sigma rule for an ATT&CK technique with log source assumptions and false-positive notes.
Apply a repeatable tuning loop that preserves security value while documenting changes and their rationale.
Distinguish missing data, missing rules, and low-confidence rules in an ATT&CK heatmap to select the next work.
4 sections · 9 lessons
Define detection engineering, connect ATT&CK techniques to telemetry, and examine why false positives arise in detection work.
2 lessonsDraft testable detection hypotheses and translate them into rule logic, then interpret and author Sigma rules linked to ATT&CK techniques.
3 lessonsApply a tuning loop to reduce false positives, document changes, and distinguish missing data, missing rules, and low-confidence coverage.
2 lessonsMonitor detection quality over time, identify when mappings and rules need review, and evaluate a portfolio decision through mapping, authoring, tuning, and gap triage.
2 lessonsDetection engineering connects adversary behavior to telemetry that can support reliable security decisions, but weak evidence, incomplete mappings, and noisy rules create blind spots. This course develops a practical framework for mapping MITRE ATT&CK techniques to logs, expressing detection logic, authoring Sigma rules, and refining results without discarding useful signals. It also addresses coverage gaps and the ongoing decisions required to keep detections relevant over time.
The course covers MITRE ATT&CK technique mapping to telemetry, evidence quality in logs, detection hypotheses and rule logic, Sigma structure and authoring, tuning loops, false-positive documentation, coverage heatmaps, and detection quality over time.
From project managers and operators to founders, analysts, and teams adopting AI, Fenzo is for people who want to get better at the work they already do.
Anything from using AI for project planning and analysis to improving workflows, decision-making, communication, and delivery. If you can describe the skill or task, Fenzo can build a course around it.
Yes. Tell Fenzo what you do, what you’re trying to accomplish, and where you’re stuck, and Fenzo will shape the course around your role, your goals, and the work you actually have to do.
No. Fenzo adapts to your starting point, so you can begin with the fundamentals or jump straight into more advanced work.
Yes. Fenzo for Business puts the whole team on one plan — shared seats, courses you can assign, and reporting on who has finished what.
See Fenzo for BusinessYou start by describing your goal or taking a short skill benchmark. Fenzo uses that context to identify gaps and shape the learning experience around them.
Yes, Fenzo works in your mobile browser.
Something to operate in every section.
Three findings from decades of learning research shaped how every Fenzo lesson is built.
Average pass rate · Freeman et al., PNAS 2014
What the science says
Students in lecture-only classes are 1.5× more likely to fail.
How Fenzo does it
Every Fenzo lesson is interactive. No passive reading or watching, ever.
You work through itAI does it for you
Skill retention over time · with vs. without practice
What the science says
Offloading thinking to AI erodes the very skills you’re trying to build.
How Fenzo does it
Fenzo makes you do the thinking — guided, but never done for you.
Retrieval practiceRe-reading
Long-term recall · retrieval vs. re-reading
What the science says
Recalling information beats re-reading it for building durable understanding.
How Fenzo does it
Lessons weave in quizzes and recall prompts, so it sticks.