After this lesson, you will be able to: Apply Detect: monitoring, anomalies, continuous monitoring.
Detect is about visibility and time-to-aware. The faster you know something's wrong, the smaller the blast radius.
Anomalies & Events (DE.AE), baseline behavior, detect deviations. Security Continuous Monitoring (DE.CM), endpoint, network, personnel monitoring. Detection Processes (DE.DP), defined, tested, communicated.
1. Centralize logs (SIEM).
2. Define detection use cases (mapped to MITRE).
3. Tune false positives ruthlessly.
4. Test detections (purple team / Atomic Red Team).
5. Measure MTTD per use case.
6. Hunt for what alerts miss.
Alerts are reactive. Hunts and threat models are proactive. Mature Detect includes both.
Sign in and purchase access to unlock this lesson.