Detection Engineering
Engineer Detections That Don't Miss
Turn raw telemetry into high-fidelity alerts. Learn to read log sources, spot coverage gaps, and write detection logic that catches the activity signatures and scanners walk right past.
Guided by The Watcher
What it is
Detection Engineering, defined
Detection engineering is the craft of turning raw telemetry — logs, events, process trees — into high-fidelity alerts. It's the difference between drowning in noise and getting one alert that actually means something. Detection engineers write and tune the logic a SOC runs on.
The career
A skill you get hired for
Attackers only need to succeed once; detection engineers build the systems that catch them every time they try. It's proactive blue-team work that decides what your organization can even see.
Builds toward
Detection Engineer
Typical salary
$135K/yr avg
Market demand
500K+ open US roles
Who you'd work alongside
- Detection engineering & SIEM content teams
- Blue teams building and tuning detections
- SOC engineers closing coverage gaps
- Anyone responsible for signal-to-noise in alerting
The DefendTheOrg approach
How you'll learn it
Under The Watcher — who wrote the rules that caught a threat group hiding for nineteen months — you write detections against real-world log data. The method starts from the attack technique and derives the logic:
Start from the technique
Understand what the attacker does first, then write the detection that catches it. The why before the what.
Precision vs recall
Every lab has realistic noise. A detection that fires on everything is worse than no detection at all — you learn to earn precision without losing coverage.
Read the source
Know what a log source can and can't tell you, and where the gaps are that you'll have to cover another way.
Stuck? Get walked through it.
Every Easy and Medium lab has a walkthrough from The Watcher — one hint at a time, with a chance to try each step yourself before the answer. You get three a week, and using one never touches your score. It teaches the reasoning, not the solution.
Try it yourself
A taste of the real lab
This is a simplified, no-signup slice of a Detection Engineering lab — make your call and see how it's graded. The real labs go deeper.
Classify this detection
The query is written. Set its metadata, then run it against the test cases.
-- Brute-force logins: 5+ failures from one IP in 5 min SELECT src_ip, count(*) AS failures FROM auth_logs WHERE event = 'login_failure' AND ts > now() - interval '5 minutes' GROUP BY src_ip HAVING count(*) >= 5;
Severity
Detection Type
Confidence
Push yourself
Where Hard and Expert labs take you
Every skill scales from your first lab to genuinely hard reasoning. Difficulty isn't a bigger wall — it's deeper thinking.
Hard
Hard labs bury a subtle behavioral pattern in realistic noise. You need to understand the technique deeply and combine multiple conditions to separate real signal from benign activity that looks just like it.
Expert
Expert labs require multi-source correlation against an adversary who's actively evading you — encoding, living-off-the-land binaries, activity split across events — so the detection only holds together when you chain logic across sources.
Start detection engineering training
Hands-on labs built from real engagement data. Learn by doing — guided by The Watcher.