Book Image

Practical Threat Detection Engineering

By : Megan Roddie, Jason Deyalsingh, Gary J. Katz
5 (2)
Book Image

Practical Threat Detection Engineering

5 (2)
By: Megan Roddie, Jason Deyalsingh, Gary J. Katz

Overview of this book

Threat validation is an indispensable component of every security detection program, ensuring a healthy detection pipeline. This comprehensive detection engineering guide will serve as an introduction for those who are new to detection validation, providing valuable guidelines to swiftly bring you up to speed. The book will show you how to apply the supplied frameworks to assess, test, and validate your detection program. It covers the entire life cycle of a detection, from creation to validation, with the help of real-world examples. Featuring hands-on tutorials and projects, this guide will enable you to confidently validate the detections in your security program. This book serves as your guide to building a career in detection engineering, highlighting the essential skills and knowledge vital for detection engineers in today's landscape. By the end of this book, you’ll have developed the skills necessary to test your security detection program and strengthen your organization’s security measures.
Table of Contents (20 chapters)
1
Part 1: Introduction to Detection Engineering
5
Part 2: Detection Creation
11
Part 3: Detection Validation
14
Part 4: Metrics and Management
16
Part 5: Detection Engineering as a Career

Scenario 1 lab

As a hands-on exercise for scenario 1, you are going to implement detections for both the hashes and network indicators based on the context we identified in the previous section during the Investigate phase. We are going to specifically focus on Sysmon as a data source for the sake of simplicity. We’ve already mentioned that there are other places where these detections could be created, both listed in the prior tables and specific to your own environment, but the process of designing and implementing the detection remains the same regardless of the data source. After walking through this exercise, you should be able to understand how to apply the same process to your use cases.

Installing and configuring Sysmon as a data source

In this part of the lab, we will integrate Sysmon as a data source in our detection engineering lab and use it to create a detection based on the list of hashes we’ve obtained from OSINT. Sysmon is not installed and configured...