← detection engineer

Metrics & Maturity — DEBMM, DML, Detection Coverage

advanced 3h

Score a detection program against DEBMM and DML, build a coverage report from rule frontmatter, and run a detection engineering retro.

After this module you will

  • › Distinguish vanity metrics from signal metrics in detection engineering
  • › Apply the 8-level Detection Maturity Level (DML) framework to a rule set
  • › Score a detection program against DEBMM L0–L4
  • › Build an ATT&CK coverage heatmap from a Sigma rule repo
  • › Propose the 3 highest-ROI maturity improvements for a fictional DE team

Lessons

1 Vanity vs. Signal Metrics — What to Measure in a Detection Program
20 min
2 Detection Maturity Level (DML) — Ryan Stillions' 8-Level Model
20 min
3 DEBMM and Elastic's Detection Maturity Framework
20 min
4 DeTT&CT — ATT&CK Coverage Heatmap and Gap Analysis
25 min

Module Quiz

Test your knowledge before moving on.

Take Quiz →