Y

Project · Advanced · about 26 hours

A detection engineering lab with tested coverage

Stand up a SIEM, ingest realistic telemetry, write a library of tested detections mapped to ATT&CK, and measure your coverage and false-positive rate.

Skills:Incident response, Monitoring and observability, Python, SIEM and security operations

Part of: Cybersecurity Engineer

Brief

Detection engineering treats detections as a tested, measured codebase. Build a lab where you can generate attacks safely, write detections, and know how good they are.

What to build

  1. Stand up a free SIEM (Elastic, Wazuh or similar) and ship logs from a couple of hosts and a network sensor

  2. Generate benign activity and a set of safe, simulated attack behaviours (for example with Atomic Red Team) on machines you own

  3. Write detections as code (Sigma or the SIEM native format), version them, and map each to an ATT&CK technique

  4. Build a test harness that replays known-bad and known-good data and reports hits and false positives

  5. Produce an ATT&CK coverage heat map and a runbook per detection

Deliverables

  • Repository with detections/, tests/, coverage/ and runbooks/

How it is graded

Reviewers run a simulated technique you have covered and one you have not, and check your coverage map is honest.

Stretch

Add automated tuning: measure each rule's false-positive rate weekly and flag noisy ones.

Deliverables

  • A running SIEM ingesting host and network telemetry
  • A version-controlled detection library mapped to MITRE ATT&CK, with tests
  • An ATT&CK coverage map and a measured false-positive rate on benign data
  • Runbooks linking each detection to triage steps

How a reviewer grades it

CriterionWeightWhat good looks like
Telemetry is realistic and detections are tested against known-bad and known-good35%
Detections are version-controlled, documented and ATT&CK-mapped25%
Coverage and false-positive rate are measured and reported25%
Runbooks make each alert actionable15%