Contents Part 3 · MITRE ATT&CK and detection engineering

Contents of the book

Start hereThe opening pages

Part 1The SOC from zero

Part 2Wazuh, a real SIEM, hands-on

What a SIEM doescoming
How Wazuh is builtcoming
Adding machines to Wazuhcoming
Watching a real attack become an alertcoming
Searching alerts like an analystcoming
Noticing when an important file changescoming
Finding vulnerable software and weak settingscoming
How a raw log becomes an alertcoming
Writing your first detection rulecoming
Blocking an attacker automatically, and why to be carefulcoming

Part 3MITRE ATT&CK and detection engineering

MITRE ATT&CK in plain wordscoming
Reading your own alerts through ATT&CKcoming
Running safe attack tests on your own labcoming
Sigma, a detection rule you can sharecoming
Running a Sigma rule against Wazuh datacoming
Writing your own Sigma rulecoming
Keeping detections in Git and testing themcoming
Measuring whether a rule is any goodcoming
Catching attacks that only show up as a patterncoming

Part 4Threat intelligence and threat hunting, by hand

Indicators of compromise, and their limitscoming
Enriching an alert with public threat intelligencecoming
Sending Wazuh alerts to other toolscoming
What threat hunting iscoming
A real hunt on a public attack datasetcoming
Writing up a huntcoming

Vulnerabilities and the software supply chainThe opening pages

What a vulnerability is, and what a CVE iscoming
CWE: the weakness behind the bugcoming
CVSS: how a vulnerability is scoredcoming
CPE: naming the software that is affectedcoming
Looking up a CVE in the NVD, by hand and with a scriptcoming
What to fix first: EPSS and the KEV catalogcoming
SBOM: the list of everything your software is built fromcoming
Package and supply-chain attackscoming
Finding and ranking the vulnerabilities in your own labcoming

Part 5AI agents from zero, for analysts

What a language model really doescoming
Getting answers your code can checkcoming
What an AI agent isfree
Giving an agent safe tools on Wazuhcoming
Every log line may be written by the attackercoming
Building a triage agent as a graphcoming
Making the agent ask a person firstcoming
Knowing what each investigation costscoming

Part 6The AI SOC team

Grouping an alert storm into one casecoming
The triage agentcoming
The enrichment agentcoming
The hunting agentcoming
The incident report writercoming
Proposing containment, with a person approvingcoming
The supervisor that runs the casecoming
A simple console for the analystcoming
When the agents go wrongcoming

Part 7Attack graphs with Neo4j

Why an attack is easier to see as a graphcoming
Neo4j from zerocoming
Loading MITRE ATT&CK into Neo4jcoming
Turning your alerts into a graphcoming
Finding the path an attacker tookcoming
Letting the agent ask the graphcoming

Part 8Prove it, and get the job

What it means for a triage agent to be goodcoming
Building a labelled test set from your own labcoming
Scoring the agents by codecoming
Judging the incident reports fairlycoming
Numbers you can trustcoming
Attacking your own agentscoming
Capstone: one full incident, start to finishcoming
The report a SOC manager asks forcoming
Turning the course into a jobcoming

Part 3 · MITRE ATT&CK and detection engineering

Measuring whether a detection rule is any good: what it catches, what it misses and what it costs the analysts

True positives, false positives and alert volume per day, measured on a week of lab traffic.

This page is being written and is not published yet

Pages are published in book order. Everything published later is included when you buy the course.

See the contents of the book or read what the course covers.