Practical training · Course outline
Build, test, and tune detections across identity, endpoint, network, and cloud logs.
Course at a glance
Turn security logs into detections your team can explain, test, and trust.
This is the course outline. Ask us about the next cohort, delivery format, and which training platforms will be available before enrolling.
A focused 35-hour course for analysts ready to move from investigating alerts to building them. Learn to choose the right log sources, write clear detection logic, test it against suspicious and benign examples, and document when a rule should fire. Finish by bringing the workflow together in a reviewable detection pack.
Check the background expected before you explore the full curriculum.
Each outcome is tied to practical investigation or engineering work.
Detection engineering turns suspicious behavior into documented security rules that a SOC can test, tune, and investigate.
Start with the behavior you want to find, check that the required logs exist, then write and validate the rule. Review benign matches so a useful detection does not become a source of unnecessary alerts.
Use Splunk SPL and KQL to express search logic against the available data. Sigma provides a structured detection-rule format, while MITRE ATT&CK helps describe the attacker behavior a rule is meant to detect. Data sources and field mappings still need validation for each environment.
Look for one source attempting sign-ins across many accounts. Check the time window and account count, then test against ordinary failed logins and authorized activity. Document why the rule should fire, when it should not, and what an analyst should investigate next.
New to investigating security logs? Explore our SOC analyst training before choosing a course focused on rule design.
Hands-on access to a platform depends on the cohort. Confirm the available environment before enrolling.
Build practical work you can discuss and explain, not just a record of attendance.
The capstone is designed to test your reasoning and rule quality.
Exercises use sample or explicitly authorized training data.
Open a module to see its key topics and proposed practice exercise.
These are the exercises planned in the course outline. Platform access is confirmed before enrolment.
Specialize in the detection lifecycle: from ATT&CK-driven strategy through SPL and Sigma authoring, correlation rules, tuning, and validation.
Across CyberAccend, our curriculum is designed and training delivered by 10+ engineers with professional experience at Microsoft, Cisco, Google and other technology companies.
Mentorship & guidance
Use mentorship to work through difficult concepts, plan what to study next, and prepare for interviews.
The course is designed for SOC analysts, junior detection engineers, and incident responders who already investigate common alerts. You should understand Windows and network logs and have introductory experience searching in a SIEM.
The syllabus includes Splunk Search Processing Language (SPL), Kusto Query Language (KQL), Sigma as a detection-rule format, and MITRE ATT&CK mapping. You work from the telemetry and fields available rather than assuming one query runs unchanged on every platform.
The published outline contains eight modules and 35 hours, covering foundations, identity, endpoint, network, cloud, response automation, AI-assisted review, and a detection-engineering capstone.
Planned exercises include a password-spray search, suspicious process-chain analysis, network-beaconing review, a cloud privilege-change rule, and an approval-gated response workflow. The capstone brings rule logic, test cases, tuning decisions, and investigation guidance into a detection pack.
SOC analyst training focuses on investigating alerts and deciding what happened. Detection engineering focuses on deciding which behavior should create an alert, which logs support the rule, how to test it, and how to reduce unnecessary noise. Investigation experience helps you design useful detections.
This page is a public course outline, not an active learner workspace. Confirm the cohort schedule, delivery format, platform access, fees, and certificate arrangements with CyberAccend before enrolling. Recordings and access to specific lab platforms are not promised by this outline.
Next step
Ask about the next cohort, course schedule, and whether your experience is a good fit.