Detection Engineer's First Week: SIEM Search and Detection Rules

<p>Varuna Cooperative Bank, a fictional Mangaluru bank, collects everything in its SIEM and alerts on nothing useful. You are its first detection engineer.</p><p>In four lessons you learn how a SIEM normalises events from many sources, how to search and pivot, what makes a good detection (precision versus recall, thresholds, allow-listing the benign look-alike), and how to write rules for four situations: password spraying, an unticketed privileged group change, beaconing to an uncategorised address, and audit logging being switched off. Your rules are scored against labels you cannot see, just as real detections are judged by what they catch and what they waste.</p><p>You work in Bartman's in-browser SIEM Lab on a day of summarised events generated for you. Part of the Bartman Cybersecurity track (Professional Certificate in Cybersecurity, LSBF).</p>

Tools: SIEM, Detection engineering, Threat hunting, Log analysis, Alert tuning