Picture the first hour of a shift. A security team’s alert queue has a few hundred new items. Some are real, and many are noise. Every item exists because someone once wrote a rule, and every rule rests on a guess about what an attacker’s behavior looks like in a log. This course teaches you to write those rules well.
An attacker does something on a system, and the system records it as a log entry. A rule watches those logs and raises an alert when it sees a match. An analyst then checks the raw logs and decides what the alert means. A false positive appears when harmless activity matches the rule too. Watch where in the chain it happens:
A technique is one specific way an attacker reaches a goal, such as stealing saved passwords.
Telemetry is the record of activity that systems produce, such as Windows Security events, Sysmon process logs, DNS queries, and web proxy logs. Without the right telemetry, no rule can see the behavior.
A detection rule is a written condition that searches telemetry for a behavior and raises an alert on a match. This course uses Sigma, a vendor-neutral rule format that converts into queries for a security information and event management (SIEM) system, the platform that collects and searches logs.
Logs gate rulesA rule cannot find what the logs never recorded. Check the telemetry before you write the rule.
Teams need a common way to say what a rule is meant to catch. MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a public catalog of attacker behavior built from real incidents. It sorts behavior into tactics, which are the attacker’s goals, and techniques, which are the methods used to reach those goals. Tagging rules with ATT&CK names lets a team see which behaviors it watches and which it does not. This is called coverage. The map below connects the catalog to logs and rules: