The blue team: detection, hunting and forensics From an analyst who reads alerts to one who makes them: detection engineering with Sigma rules and MITRE ATT&CK, hypothesis-led threat hunting, and digital forensics from collecting evidence to the timeline.
Lessons 0 Overview From an analyst who reads alerts to one who makes them: detection engineering with Sigma rules and MITRE ATT&CK, hypothesis-led threat hunting, and digital forensics from collecting evidence to the timeline. 1 Detection engineering: write the rule that catches the attacker In the junior stage you read alerts. Here you write them: where the logs that matter come from in Windows and Linux, how to describe suspicious behaviour in a Sigma rule any SIEM understands, how to test it with a simulated attack, measure its precision, and treat it as code in Git. 2 Threat hunting and threat intelligence Alerts catch what we already know. Hunting looks for what fired no alert: you start from a hypothesis drawn from intelligence, search the data, and turn what you find into a rule. Here you learn the Pyramid of Pain, the levels of intelligence and how it is shared, and how to hunt an attacker's regular call-backs with code. 3 Digital forensics and a first look at malware Once an incident happens the question moves from "did something happen?" to "what exactly happened, when and how?". Here you learn the order for collecting evidence before it vanishes, the chain of custody, imaging with hashes, memory analysis, and a timeline from Windows artefacts, then how to examine a suspicious file safely with static and dynamic analysis and YARA rules. 4 Wrap-up and resources The takeaways and glossary of this track.