Detection Engineering
9 practice items · needed by 1 role
Easy 1Medium 2Hard 6
Practice questions
- False positive or false negative?easy
- Why write detections in Sigma?medium
- The Pyramid of Painmedium
- Why a 99% accurate rule floods the SOChard
- Detecting DCSynchard
- Why the JNDI rule missed attackshard
- Trusting a green ATT&CK heatmaphard
- When a trusted update is malicioushard
- Why honeytokens are high fidelityhard