← detection engineer

Writing Good Detections — Precision, Recall, Robustness

intermediate 4h

Reason about precision, recall, robustness to evasion, and analyst burden when designing a detection.

After this module you will

  • › Explain the precision / recall / robustness trade-off triangle
  • › Score a detection against the five robustness levels from Summiting the Pyramid
  • › Identify evasion techniques (command-line obfuscation, LOLBins, signed-binary proxy)
  • › Design an alert that carries enough context for analyst triage
  • › Rewrite a high-FP rule into a high-precision behavioral detection

Lessons

1 Precision, Recall, and Robustness — The Detection Quality Triangle
25 min
2 Writing at L3 and Above — Deliberately Designing Robustness
25 min
3 Evasion Techniques — What Breaks Your Rules
30 min
4 Designing for the Analyst — Alert Context and Triage Experience
20 min
5 Worked Example: Redesigning a Noisy wmic shadowcopy Rule
30 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →