HackBlue

Tools · Workbench

SIEM and detection engineering

Tutorials on Splunk SPL, Elastic KQL and ES|QL, Microsoft Sentinel KQL, Sigma rules, alert tuning, and triage.

  • 24 lessons
  • 4 h of reading
  • 4 topics
Start with lesson 1All workbenches

A detection is a question you ask the logs on a schedule. These tutorials cover the query languages people use to ask those questions, how to write a rule that survives contact with real data, and how an analyst decides what an alert means.

The sample searches use lab data and field names you can map to your own sources. Test every rule against a known-good week before it pages anyone.

Query languages

6 lessons

  1. 01Splunk SPL for beginners: index, sourcetype, fields, and the search pipelineWrite your first useful Splunk searches: scope by index and time, filter on fields, pipe into table and sort, and avoid the slow patterns that make searches crawl.11 min
  2. 02Splunk stats, timechart, and eval: turning raw events into detectionsUse stats with dc, values, earliest, and latest, create fields with eval, chart activity over time, and combine them into a simple threshold detection.11 min
  3. 03KQL for security analysts: where, project, summarize, and extend in Microsoft SentinelLearn Kusto Query Language through security tables such as SigninLogs, SecurityEvent, and DeviceProcessEvents, and write queries that summarize activity and highlight outliers.11 min
  4. 04Correlating events in KQL: join, let, and time windows for multi-step detectionsJoin two tables to connect a sign-in with a later action, use let to build reusable subqueries, and limit correlations to a time window so results stay meaningful.12 min
  5. 05Elastic Security queries: KQL in Kibana, EQL sequences, and ES|QL pipelinesUnderstand the three query languages in the Elastic stack, when to use each, and how ECS field names make the same query work across data sources.11 min
  6. 06Regular expressions for log analysis: extracting IPs, users, and URLs safelyBuild regular expressions step by step to pull fields out of log lines with grep, Splunk rex, and KQL extract, and avoid patterns that are slow or match too much.10 min

Rule formats

2 lessons

  1. 01Sigma rules tutorial: writing vendor-neutral detections in YAMLLearn the structure of a Sigma rule, write one for a suspicious process pattern, and understand logsource, detection selections, conditions, and false positive notes.12 min
  2. 02Suricata eve.json tutorial: reading alerts, flows, and protocol logs with jqRun Suricata against a lab pcap, understand the eve.json event types, and use jq to summarize alerts by signature, source, and destination.10 min

Detection patterns

5 lessons

  1. 01Detecting impossible travel sign-ins: logic, false positives, and a working queryCompute travel speed between consecutive sign-ins for each user, understand why VPNs and mobile networks trigger false positives, and make the detection useful.10 min
  2. 02Hunting in DNS logs: newly seen domains, DGA-like names, and tunneling signsUse DNS query logs from a resolver or endpoint to find rare domains, long random-looking names, high query volume to one domain, and unusual record types.11 min
  3. 03Reading web server access logs for attacks: scanners, brute force, and odd status codesParse nginx or Apache access logs with command-line tools, find scanners by 404 bursts and user agents, spot login brute forcing, and flag suspicious paths and parameters.10 min
  4. 04Brute force versus password spraying: writing detections that tell them apartModel the two attack shapes from authentication logs, write one query that classifies sources by attempts per user and users per source, and choose thresholds.9 min
  5. 05Linux detections in a SIEM: auditd and syslog queries for common attacker behaviorTurn auditd and authentication logs into SIEM detections for new sudoers entries, cron changes, reverse-shell-like process patterns, and suspicious use of tools like curl piped into a shell.10 min

Detection practice

11 lessons

  1. 01The detection engineering lifecycle: from idea to tested, tuned, and retired rulesFollow a detection from a threat idea through data checks, rule writing, testing, deployment, tuning, and review, and learn what to document at each step.10 min
  2. 02Mapping detections to MITRE ATT&CK and building a coverage heatmap with NavigatorTag rules with ATT&CK technique IDs, export them as an ATT&CK Navigator layer, and read the heatmap honestly, including what coverage does and does not mean.10 min
  3. 03Alert triage for SOC analysts: a repeatable method for deciding true or false positiveUse a consistent sequence for every alert: understand the rule, establish the entities, gather context, form a hypothesis, decide, and document so the next analyst benefits.11 min
  4. 04Tuning noisy detections without creating blind spotsReduce false positives with narrow, documented exclusions, avoid exclusions attackers can easily abuse, and measure tuning impact before and after.10 min
  5. 05Detection as code: storing rules in Git with tests and CI checksKeep detection rules in a repository, lint and convert them in CI, test them against sample events, and deploy through pull requests instead of editing in the SIEM console.11 min
  6. 06Validating detections with Atomic Red Team in a labUse small, documented Atomic Red Team tests in an isolated lab VM to confirm that telemetry is collected and that your rules fire, then clean up and record the results.11 min
  7. 07Threat hunting with hypotheses: plan, query, analyze, and turn findings into detectionsWrite a testable hunting hypothesis, choose data and queries, analyze results with stacking, and convert what you learn into new or improved detections.10 min
  8. 08The Pyramid of Pain: why behavior-based detections outlast indicator listsUnderstand the levels of the Pyramid of Pain, compare hash and IP indicators with behavior detections, and decide how to use threat intelligence feeds well.8 min
  9. 09Onboarding a new log source into a SIEM: parsing, normalization, and health checksPlan what a new source must provide, map its fields to a common schema like ECS, ASIM, or CIM, check timestamps and time zones, and monitor the feed so silence becomes an alert.10 min
  10. 10Writing alert runbooks analysts actually useStructure a runbook for one detection with purpose, quick checks, pivots, decision criteria, and escalation steps, and keep it short enough to follow under pressure.8 min
  11. 11Detection program metrics: alert quality, time to triage, and coverage you can defendChoose a small set of metrics that show whether detections are useful, compute them from case data, and avoid metrics that reward the wrong behavior.8 min