Module 2: From Evidence to Logic

Master the path from raw log evidence to detection logic — field anatomy, query building, and false positive management.

3 lessons · 2 labs

Wazuh

Path

  1. 01
    Lesson

    Lesson 2.1 — Log Anatomy for Detection

    Understanding field structures, normalization, parsing — the raw material of every detection rule.

  2. 02
    Lab

    Lab 2.1 — From Evidence to DQL Query

    Analyze raw alert fields in the shared Wazuh environment, build detection queries from evidence, and validate that they match the expected events.

  3. 03
    Lesson

    Lesson 2.2 — Building Detection Logic

    From observable to hypothesis to query to rule — the detection engineering workflow.

  4. 04
    Lab

    Lab 2.2 — Tuning a Noisy Rule

    Investigate a high-volume rule in the shared Wazuh data, separate true positives from false positives, and build exclusion filters that preserve detection coverage.

  5. 05
    Lesson

    Lesson 2.3 — False Positive Management

    Baselining, whitelist strategies, tuning without losing coverage.