Purple Edge
Get started

Detection Engineering

intermediate7 labsSubscription

Design the detections a SOC relies on: endpoint telemetry, MITRE ATT&CK mapping and coverage, Sigma rules as code, testing and tuning against false positives, hunting that ends in new rules, and a hands-on capstone that tests, tunes and maps a real rule.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Subscription

    Detection Engineering Basics: From Telemetry to Alert

    What a detection engineer does, where the data comes from, how one event becomes an alert, and the four ways a rule can be right or wrong.

    35 min3 tasksfoundations
  2. 2
    intermediate Subscription

    MITRE ATT&CK for Defenders

    Use MITRE ATT&CK as a shared language for attacker behaviour: read its IDs, map what you see in the logs to a technique, and measure where your detections are missing.

    40 min3 tasksfoundations
  3. 3
    intermediate Subscription

    Writing Detections with Sigma Rules

    Write a detection once in Sigma, an open rule format, then turn it into a query for whichever SIEM you run.

    45 min3 tasksfoundations
  4. 4
    intermediate Subscription

    Testing and Tuning Detections

    Prove a rule fires on the real thing and stays quiet on normal work, tune it without opening blind spots, and keep every rule tested and reviewed as code.

    45 min3 tasksfoundations
  5. 5
    intermediate Subscription

    Hunting in Endpoint Logs

    Rules catch what you already know to look for. Hunting looks for what they missed, starting from a written hypothesis, and ends by turning what you found into a new rule.

    45 min3 tasksfoundations
  6. 6
    intermediate Subscription

    Detecting a Multi-Stage Intrusion

    Real intrusions are sequences. Follow one recorded intrusion through three stages, see exactly which events each stage leaves, and turn every stage into a detection.

    45 min3 tasksfoundations
  7. 7
    intermediate Hands-on lab Subscription

    Capstone: Test, Tune and Map a Detection

    Deploy a real lab, test a draft Sigma rule against recorded endpoint telemetry, tune out the documented false positive, confirm the true positive, update the ATT&CK coverage, and capture the flag.

    75 min3 tasksfoundations

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-11-01

We use cookies for analytics and advertising to improve Purple Edge and measure our campaigns. You can accept or decline non-essential cookies.