What this book covers
Chapter 1, Fundamentals of Detection Engineering, provides an introduction to the foundational concepts that will be referenced throughout the book. It also defines detection engineering to help you understand what exactly detection engineering is.
Chapter 2, The Detection Engineering Life Cycle, introduces the phases of the detection engineering life cycle and different types of continuous monitoring. Each phase of the life cycle will be discussed in depth in later chapters.
Chapter 3, Building a Detection Engineering Test Lab, introduces the technologies that will be used to build a detection engineering test lab. The subsequent hands-on exercises will teach you how to deploy the detection engineering lab that will be leveraged for future labs throughout the book, and how to create a simple detection.
Chapter 4, Detection Data Sources, discusses what detection data sources are, their importance, and the potential challenges faced when leveraging data sources. It will then provide a hands-on exercise to connect a new data source to the detection engineering test lab.
Chapter 5, Investigating Detection Requirements, looks at the first two phases of the detection engineering life cycle. It discusses how to identify and triage detection requirements from a variety of sources and the related methods and processes to be implemented.
Chapter 6, Developing Detections Using Indicators of Compromise, discusses the use of indicators of compromise for the purpose of detection engineering. The concept is demonstrated through an example scenario based on a real-life threat. As part of the exercise, Sysmon will also be introduced and installed in the detection engineering lab.
Chapter 7, Developing Detections Using Behavioral Indicators, builds on Chapter 6 by moving on to developing detections at the behavioral indicator level. Two scenarios and associated exercises are leveraged to introduce the concept: one focused on detecting adversary tools and one focused on detecting tactics, techniques, and procedures (TTPs).
Chapter 8, Documentation and Detection Pipelines, provides an overview of how detections should be documented in order to effectively manage a detection engineering program. It then introduces concepts related to deployment processes and automation, such as CI/CD, along with a lab to demonstrate creating a detection pipeline.
Chapter 9, Detection Validation, provides an overview of validating detections using various methodologies. It will introduce two tools, Atomic Red Team and CALDERA, that can be used for performing validation. An associated hands-on exercise will allow you to work with these tools in your detection engineering test lab.
Chapter 10, Leveraging Threat Intelligence, provides an introduction to cyber threat intelligence with a focus on how it relates to detection engineering. A series of examples is used to demonstrate the use of open source intelligence for detection engineering. Additionally, the chapter will discuss the use of threat assessments to develop detection requirements.
Chapter 11, Performance Management, provides an overview of how to evaluate a detection engineering program as a whole. It includes methodologies for calculating the effectiveness and efficiency of the detections in an organization. Then, it discusses how such data can be used to improve the detection engineering program.
Chapter 12, Career Guidance for Detection Engineers, closes off the book with a discussion on careers in detection engineering. This includes finding jobs, improving your skill sets, and associated training. It then provides insights into the future of detection engineering as a field. Finally, it looks at ways in which detection engineers can contribute to the community.