Module 8: Capstone — Detection Portfolio

Measure coverage, communicate value to leadership, and build a professional detection engineering portfolio.

3 lessons · 2 labs

SigmaSuricata + EveBoxYARAWazuh

Path

  1. 01
    Lesson

    Lesson 8.1 — Measuring Detection Coverage

    ATT&CK heatmaps, coverage scores, gap prioritization, and tracking improvement over time.

  2. 02
    Lab

    Lab 8.1 — Generate an ATT&CK Coverage Map

    Map all detections built throughout the course to ATT&CK techniques, generate a coverage heatmap, and identify remaining gaps with a prioritized remediation plan.

  3. 03
    Lesson

    Lesson 8.2 — Communicating Detection Value

    Executive dashboards, ROI metrics, risk reduction narratives, and stakeholder presentations.

  4. 04
    Lab

    Lab 8.2 — Capstone: Detection Engineering Portfolio

    Compile your best Sigma, Suricata, and YARA rules into a professional portfolio with documentation, test results, coverage metrics, and an executive summary.

  5. 05
    Lesson

    Lesson 8.3 — Building Your Detection Portfolio

    Career artifact creation, showcasing skills, continuous improvement plans, and professional development.