An analyst may investigate a suspicious-login alert correctly yet still need help building and validating the rule behind it. That gap calls for practice in detection engineering.
Detection engineering is the work of developing, testing and maintaining the logic that identifies suspicious activity in security data. In the ISC2 2025 Cybersecurity Workforce Study, 95% of respondents reported at least one skills need, and 59% described their needs as critical or significant.
Those figures cover cybersecurity overall, not detection engineering specifically. For managers choosing training, the practical starting point is a named task the team needs to perform and a way to assess the resulting work.
Key takeaways
- Identify the missing task. Run a short diagnostic before reading course pages, so you can match training to a specific gap.
- Inspect the practical assessment. Check what learners must build, how their work is assessed and what feedback they receive.
- Require a reviewed work sample. Use a peer-reviewed detection package to assess whether learning transferred.
Start with the work your team cannot yet demonstrate
Before comparing courses, find out which parts of the detection lifecycle your analysts can already perform.
Use a short diagnostic exercise with approved sample logs in an isolated training environment. Three tasks help you assess how analysts interpret data, test detection logic and maintain rules.
Read the evidence. Ask the analyst to identify the fields in a sample log that matter for a given behaviour, such as a scheduled task created by an unexpected account, and name the log source that supplies them.
The Sigma rules specification, a shared format for writing detections, keeps the log source, the detection logic and descriptive details such as the title and description in separate parts of a rule. That structure gives the exercise a useful frame.
Build and test. Ask them to explain a proposed detection in words, then describe how they would tell suspicious activity apart from routine administration.
Sigma includes an optional falsepositives field for listing known false positives that may occur. Check whether the learner names those benign triggers without prompting.
If your team works in a SIEM, a platform for collecting and analysing security logs, have them sketch the query there.
Review and maintain. Ask how a rule change would be reviewed, who would approve it and how they would confirm that it still detects the intended activity after system changes.
This applies even where a managed detection and response service handles alert triage, since the team still needs people who understand the rules tuned to its own environment.
Record the results in a simple matrix with three levels for each task: needs practice, can do with review and can do independently.
Use this internal planning aid to choose one priority gap per analyst. Where people need different practice, assign training that addresses those differences.
Choose training by the evidence it asks learners to produce
Compare each syllabus with the task you identified in the diagnostic. Check whether learners will practise that task and produce work you can review afterwards. Use these four criteria to assess the fit.
| Criterion | What to check |
| Prerequisites | Does the provider state the recommended experience and offer a demo or sample exercise? Use it to check whether the analyst is ready to begin. |
| Curriculum | Does it cover relevant log analysis, rule creation, tuning and version control? Ask when the syllabus was last reviewed. MITRE released ATT&CK v20 on 13 October 2026, so check which version the course maps to. |
| Assessment | Is there a practical task with submitted evidence? Distinguish an assessed certification from a certificate of completion, and ask what feedback learners receive. |
| Delivery and cost | Check access periods, lab arrangements, support and whether the exam is included. Add the analyst’s learning time when estimating the employer’s total cost. |
For a structured certification route, the Centri CDEA curriculum includes automating detection workflows with Git, creating and tuning network detection rules, and creating and tuning Sigma rules.
Centri recommends one to three years of experience, offers a free demo for checking fit and certifies learners through a practical exam.
Those details give managers concrete topics and an assessment format to compare with their skills matrix.
The course page lists four months of on-demand access, so confirm the current price and any team terms with the provider before you plan the budget.
Other routes suit different gaps. Level Effect’s Detection Engineering Fundamentals lists six exercises, no assessments and free access, which makes it an introductory option for a conceptual gap.
SANS SEC555: Detection Engineering and SIEM Analytics lists 18 hands-on labs, a practice provision worth examining for a gap in SIEM analytics.
These formats serve different purposes, so check the exercises and assessment requirements against the task your analyst needs to learn.
Turn learning into a reviewed team capability
After training, assess how the analyst applies the learning in your environment. Build practice time, a work sample and a follow-up review into the plan before enrolment.
Protect practice time. Check access deadlines and lab arrangements, then block learning time in the rota. Protect those sessions from routine queue work so the analyst can complete exercises and act on feedback.
Review a work sample. Within a few weeks of finishing, ask each learner to produce a short detection package: the behaviour being detected, the logs required, the rule or query, test evidence gathered in an authorised and isolated environment, known benign triggers and a named maintenance owner.
Route it through the team’s existing change process. In Sigma, the falsepositives field only lists known false positives, while exclusions are written separately, for example as Sigma filters. The package should therefore explain how each benign trigger will be handled.
Recheck after feedback. Ask the learner to explain why a detection failed and show how they would improve it. A passed practical exam shows applied skill under assessment conditions. Follow it with reviewed work in your environment to confirm that the learning transferred.
Keep the first pilot small: one analyst, one diagnosed gap, one course and one reviewed detection package.
Set the review criteria before training begins, including required data, test evidence and handling of benign triggers. If the sample needs revision, give the analyst time to correct it and submit it for another review.
Build the capability one reviewed detection at a time
Detection engineering skill grows through practice and review rather than course completion alone.
Start with a diagnostic that names the missing task, choose training that makes learners produce reviewable work, then confirm the result with a detection package that passes your own change process.
Small, evidence-based pilots give managers a clear record of what each analyst can now do and where the next round of practice should focus.
FAQ
What is the difference between detection engineering and alert triage? Alert triage investigates alerts that already exist. Detection engineering designs, tests and maintains the logic that produces those alerts.
Do analysts need coding skills to start? Basic scripting and query skills help, but the diagnostic shows where to begin. Some introductory courses list no prerequisites, while some intermediate certifications recommend one to three years of security experience.
What should a detection package include? The behaviour being detected, the required logs, the rule or query, test evidence from an isolated environment, known benign triggers and a named maintenance owner.
How often should detection rules be reviewed? Review them after relevant system changes, after tuning feedback and when frameworks you map to, such as MITRE ATT&CK, publish a new release. MITRE issues major ATT&CK releases each April and October.
