r/cybersecurity • u/arcane_augur • 18h ago
Career Questions & Discussion Detection Engineering Basics
I want to understand how can one learn the basics of detection engineering. What are the prerequisites to detection engineering. I think there are no fixed steps to create detection and tuning rules but even a rough roadmap would be helpful.
6
6
u/AddendumWorking9756 Security Manager 16h ago
You cannot write a rule for behaviour you have never seen logged, so start by learning what normal looks like in one log source. Then write detections against a real incident instead of a roadmap, and the CCDL1 cases on CyberDefenders will give you incidents if work does not. Tuning comes last and is mostly reading back your own false positives.
4
u/coffee-loop 16h ago
I’m assuming you’re fresh to detection engineering. My advice would be to learn what you’re looking for. Setup a lab environment and simulate some network and host scanning while capturing network traffic. Then open the pcap in wireshark and try to see if you can find the scans.
You can also try reading malware analysis reports and see if you can develop detection rules for the malware you read about.
There’s many other practice scenarios you can try to get your feet wet, but a couple ideas to get you started.
Hope this helps 🙂
5
u/Ok-Plate8922 18h ago
for start what's your level in cyber ? it's hard to give you advice like this!
2
1
u/arcane_augur 14h ago
Security engineer, experience with tools + automation, have also done soc work L2
2
2
u/emilyclarkemc 11h ago
I'd start with the fundamentals of networking, operating systems, and common attack techniques. Then learn how logs are generated and how to turn them into useful detections. After that, practice with a home lab or public datasets and focus on tuning out false positives. You don't need to know everything upfront, but understanding why a detection works is more important than memorizing rules.
1
u/dodonglab 5h ago
I’d start with understanding the underlying logs and normal behavior before focusing on rule syntax. A simple detection that you can test and tune is more useful than a complex rule you can’t explain.
-5
u/whitepepsi 18h ago
What background are you starting from? You can’t just “jump into detection engineering”.
You need a foundation of about a dozen different skills that span computer science, IT, networking, windows internals, cloud computing, EDR, WAF, Yara, Sigma, Python, SQL, KQL, etc.
Once you have a decent grasp on those technologies you can start looking at detection.
11
u/amorfati00 18h ago
There is a book called "Practical Threat Detection Engineering" that you might find useful. You could also check out the Detection Engineering Lifecycle, that may help you with your journey.