Detection Engineering 2026: 100 Priority Use Cases and Correlation Rules

A SOC is only as good as its detections, and most detections fail in the same few ways: they fire on noise, they miss the real attack, nobody knows what to do when they trigger, or they quietly stop working when a parser or log source changes. This course treats detection as an engineering discipline. Every rule has a written hypothesis, portable logic, documented tuning, a defined response, a safe way to prove it works, and an owner who keeps it current. It is built around a reference set of 100 high-priority use cases, alert detections and correlation rules, organised into 20 detection domains that follow the attack path, from external exposure and initial access through execution and movement to impact, threat intelligence, correlation and the health of detection itself. The programme starts with how each use-case card is built and how to trace a rule back to MITRE ATT&CK v19.2, from technique to detection strategy, analytic, data component and finally your own log source. It then sets out the Standard Playbook that applies to every rule: tuning controls T1 to T3, analyst investigation steps I-1 to I-7, the careful and fast containment stances, the five outcomes every safe validation must show, and the production readiness gate R-1 to R-6. From there, learners work through all 20 domains: vulnerability and exposure; web, WAF and application attacks; email and collaboration; identity and authentication; SaaS, Microsoft 365 and OAuth; Active Directory and Kerberos; endpoint execution and living-off-the-land binaries; persistence and privilege escalation; credential access; discovery and lateral movement; defence impairment and stealth; network, DNS, proxy and command-and-control; cloud IaaS; containers and Kubernetes; DevOps, CI/CD and source control; collection and exfiltration; ransomware and impact; threat intelligence and IOCs; cross-source attack chains; and detection health and telemetry. For each rule, learners study the threat hypothesis, the vendor-neutral WHEN, GROUP BY, WINDOW and THEN logic, the required fields, the rule-specific tuning control, the response actions and the safe validation test with its example timeline. The recurring question throughout is whether a detection can be trusted in production: does it have the telemetry it needs, does it fire exactly once on the right activity, are its exceptions narrow and time-limited, can an analyst build the timeline, and has someone proved it still works since the last change? The final domains bring this together through correlation rules that turn low-level signals into high-confidence attack stories, and through health rules that watch the monitoring itself. Assessment is an online 20-question exam at a 70% pass mark, leading to a verifiable SKEDMIA certificate.