Detection Engineering

Sigma, SPL, KQL — and the discipline of detection-as-code

A practical track on the discipline of writing, tuning, and operationalizing detections at scale. Detection Engineering is what separates a reactive SOC from one that catches threats early. Author detections in Sigma/SPL/KQL and translate between them, map to MITRE ATT&CK and measure coverage, tune for low false-positive rate without losing true positives, test with Atomic Red Team + Caldera, ship via a content-as-code pipeline.

Lessons

• Detection Engineering as a Discipline
• Sigma: Write Once, Deploy Anywhere
• Splunk SPL Deep Dive
• Microsoft Sentinel KQL Deep Dive
• ATT&CK-Driven Detection Coverage
• Tuning: FP/FN Balance, Alerting Strategies
• Adversary Emulation and Detection Testing
• Capstone: Build a Detection Pipeline