Cyber Wiki Learning Path
Security Operations and Detection Engineering
Move from telemetry and logs to normalized data, detections, triage, enrichment, automation, and coverage measurement.
Recommended Sequence
91 connected entries
AI Audit Evidence Integrity
AI audit evidence integrity is the ability to show that logs, model artifacts, data extracts, test results, approvals, and screenshots are authentic, complete, attributable, and unchanged.
AI assurance · AdvancedAI Audit Sampling Strategy
An AI audit sampling strategy selects transactions, prompts, outputs, decisions, users, periods, or model versions in a way that supports the audit objective and exposes meaningful failure modes.
AI controls · AdvancedAI Control Monitoring
AI control monitoring observes whether preventive, detective, and corrective controls remain active, correctly configured, sufficiently covered, and effective as systems change.
AI lifecycle governance · FoundationalAI Model Lifecycle
The AI model lifecycle covers conception, data, development, testing, release, operation, change, retirement, and evidence preservation.
AI operational resilience · AdvancedAI Operational Readiness Review
An AI operational readiness review verifies that ownership, support, monitoring, incident response, continuity, capacity, user guidance, and rollback are ready before production use.
AI operations governance · IntermediateAI Post-Deployment Monitoring
AI post-deployment monitoring measures whether a released system continues to perform, comply, and behave safely in its actual environment.
AI security management · AdvancedAI Security Metrics Governance
AI security metrics governance defines which measures support decisions, how they are calculated, who owns them, and how limitations and thresholds are communicated.
AI incident response · AdvancedAI System Incident Response
AI-system incident response adapts preparation, detection, analysis, containment, recovery, and learning to failures and attacks involving models, data, prompts, outputs, pipelines, and automated decisions.
AI third-party risk · AdvancedAI Vendor Control Monitoring
AI vendor control monitoring evaluates whether a provider continues to meet security, privacy, resilience, transparency, and notification commitments after onboarding.
Agile delivery · IntermediateAgile Psychological Safety
Agile psychological safety is the shared confidence that people can raise concerns, admit uncertainty, ask for help, challenge assumptions, and report mistakes without retaliation or humiliation.
Agile delivery · IntermediateAgile Suitability Assessment
Agile suitability assessment examines uncertainty, feedback availability, delivery constraints, stakeholder access, technical coupling, compliance, and organizational readiness before choosing an approach.
Detection engineering · AdvancedAlert Actionability Engineering
Alert actionability engineering designs alerts so a responder can understand the condition, impact, evidence, urgency, owner, and next safe step.
Triage practice · IntermediateAlert Classification and Routing
Alert classification and routing apply consistent categories, ownership rules, urgency, evidence requirements, and destination workflows so alerts reach the right responder quickly.
Detection engineering practice · IntermediateAlert Engineering
Alert engineering turns observable behavior and use cases into actionable detection logic with defined context, thresholds, evidence, owner, response path, and validation test.
Triage practice · IntermediateAlert Prioritization
Alert prioritization combines severity, confidence, asset importance, user context, exposure, active threat evidence, and potential business impact to order analyst attention.
Operations management practice · IntermediateAlert Response Capacity Management
Alert response capacity management balances incoming alert demand, analyst skill, queue health, service expectations, automation, and surge plans to keep response sustainable.
Security operations · FoundationalAlert Triage
Alert triage is the rapid, evidence-based process of validating a security alert, estimating urgency and impact, and deciding the correct next action.
Security operations practice · IntermediateAntivirus, EDR, and XDR
Antivirus, EDR, and XDR is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Asset management practice · BeginnerAsset Inventory
An asset inventory is an authoritative record of the hardware, software, services, cloud resources, data stores, operational technology, and other components the organization must manage and protect.
Logging governance practice · IntermediateAudit Log Retention and Integrity
Audit log retention and integrity controls preserve security-relevant records for operational analysis, investigations, accountability, compliance, and legal needs.
Architecture practice · AdvancedAudit Logging Architecture
Audit logging architecture defines which events are produced, transported, normalized, protected, retained, correlated, analyzed, and made available for investigations and accountability.
Security operations automation · AdvancedAutomated Remediation Guardrails
Automated remediation guardrails constrain corrective actions by confidence, impact, scope, authorization, reversibility, and evidence quality.
Agile delivery · IntermediateBacklog Prioritization
Backlog prioritization orders work using value, urgency, risk, learning, dependencies, cost of delay, capacity, and strategic commitments.
Agile delivery · IntermediateBacklog Refinement and Clarity
Backlog refinement develops shared understanding of upcoming work by clarifying value, users, scope, acceptance, dependencies, risk, and an appropriate level of detail.
Infrastructure analysis technique · AdvancedCertificate Transparency Analysis
Certificate transparency analysis examines publicly logged certificate issuance to discover domains, subdomains, infrastructure relationships, and changes over time.
Change management · AdvancedChange Automation Evidence
Change automation evidence records what an automated change intended, who authorized it, what code and inputs ran, which targets changed, and whether outcomes matched the plan.
Assurance practice · AdvancedCloud Audit Evidence
Cloud audit evidence demonstrates how cloud controls are designed and operating through configuration, logs, assessments, access reviews, provider reports, tickets, approvals, and automated test results.
Operational practice · IntermediateCloud Automation and Orchestration
Cloud automation performs repeatable tasks through code and APIs, while orchestration coordinates multiple automated steps into a controlled workflow.
Security architecture · AdvancedCloud Control Plane Security
The cloud control plane contains the APIs, consoles, identities, and orchestration functions used to create and change cloud resources.
Audit control · IntermediateCloud Control-Plane Logging
Cloud control-plane logging records administrative and API actions that create, change, or delete cloud resources and policies.
Financial monitoring · IntermediateCloud Cost Anomaly Detection
Cloud cost anomaly detection identifies unexpected changes in spend or usage that may indicate waste, configuration errors, abuse, compromise, or legitimate demand changes.
Data governance practice · AdvancedCloud Data Governance
Cloud data governance assigns ownership and rules for classification, access, quality, lineage, retention, location, sharing, and disposal across cloud data services.
Audit and detection control · AdvancedCloud Data-Access Logging
Cloud data-access logging records reads, writes, deletes, queries, exports, and sharing actions involving stored or managed data.
Forensic practice · AdvancedCloud Forensics
Cloud forensics collects and analyzes provider logs, snapshots, object versions, identity records, network evidence, and service metadata for investigation.
Investigation practice · AdvancedCloud Logging and Forensic Readiness
Cloud forensic readiness ensures that logs, snapshots, metadata, identities, timestamps, and response procedures are available before an incident requires them.
Operational control · IntermediateCloud Logging and Monitoring
Cloud logging and monitoring collect, protect, correlate, and analyze events from identities, control planes, networks, workloads, applications, data services, and security tools.
Network telemetry · IntermediateCloud Network Flow Logs
Cloud network flow logs record summarized connection metadata from virtual networks, interfaces, gateways, and security controls for monitoring, troubleshooting, and investigation.
Operational practice · IntermediateCloud Observability
Cloud observability uses logs, metrics, traces, events, and context to understand system behavior and investigate unexpected conditions.
Security operations capability · IntermediateCloud Security Posture Management
Cloud security posture management continuously evaluates cloud resources and configurations against security baselines, architecture rules, and compliance requirements.
Reliability practice · IntermediateCloud Service-Level Objectives
Service-level objectives define measurable reliability targets for a service, such as availability, latency, durability, or successful request rate.
Cloud detection practice · AdvancedCloud Storage Exfiltration Detection
Cloud storage exfiltration detection looks for unusual reads, downloads, copies, sharing changes, presigned access, cross-account movement, and data-transfer patterns.
Detection capability · AdvancedCloud Threat Detection
Cloud threat detection identifies suspicious behavior across identities, control planes, workloads, networks, storage, and managed services.
Detection practice · IntermediateCommand and Control Detection
Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.
Detection content practice · IntermediateCommunity-Sourced Detection Content
Community-sourced detection content includes shared rules, signatures, queries, mappings, and playbooks that can accelerate coverage when teams validate and adapt them to local data and risk.
Vision AI · FoundationalComputer Vision Systems
Computer vision systems extract patterns from images or video to classify, detect, segment, track, or generate visual content.
Configuration management · AdvancedConfiguration Drift Remediation
Configuration drift remediation detects differences from approved baselines, determines cause and risk, and restores or formally accepts the intended state.
Assurance practice · AdvancedContinuous Control Monitoring
Continuous control monitoring uses defined data, tests, and review cycles to identify changes in control condition and risk between formal assessments.
Detection practice · IntermediateData Exfiltration Detection
Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.
Cloud data security · AdvancedData Lakehouse Security
Data lakehouse security applies consistent identity, governance, classification, encryption, isolation, and audit controls across open files, metadata catalogs, compute engines, and analytic tables.
Data operations · IntermediateData Quality Monitoring
Data quality monitoring continuously evaluates whether incoming and stored data meet defined expectations for structure, completeness, validity, freshness, consistency, and distribution.
Detection engineering · AdvancedDatabase Activity Monitoring
Database activity monitoring analyzes database sessions and commands to identify suspicious access, policy violations, misuse, and operational anomalies.
Database monitoring · IntermediateDatabase Audit Logging
Database audit logging records security-relevant access, administrative changes, authentication events, and sensitive data operations with enough context for investigation and assurance.
Database resilience · AdvancedDatabase Point-in-Time Recovery
Point-in-time recovery combines a consistent base backup with ordered transaction logs so a database can be restored to a selected moment before an error or attack.
Detection-program assessment · AdvancedDetection Coverage and Gap Analysis
Detection coverage and gap analysis determines which priority adversary behaviors, misuse cases, control failures, and business risks are observable and actionable, and where missing telemetry, analytic logic, context, or response capacity leaves a gap.
Detection engineering practice · IntermediateDetection Data-Source Requirements
Detection data-source requirements specify the events, fields, timestamps, identity context, retention, quality, and availability an analytic or investigation needs.
Detection engineering practice · IntermediateDetection Tuning Feedback Loops
Detection tuning feedback loops use analyst dispositions, missed detections, environmental change, testing, and workload evidence to improve analytic precision without erasing useful coverage.
Detection engineering · AdvancedDetection Use-Case Acceptance Criteria
Detection use-case acceptance criteria define the threat behavior, data, logic, context, expected alert, performance, ownership, response path, and evidence required before a detection is treated as operational.
Detection engineering practice · IntermediateDetection Use-Case Engineering
Detection use-case engineering converts priority threats and business exposure into defined data needs, analytic logic, triage steps, expected evidence, and validation criteria.
Assurance practice · IntermediateDetection Validation and Testing
Detection validation and testing confirms that analytics receive required data, trigger on expected behavior, generate useful evidence, route correctly, and continue working after environmental change.
Detection engineering practice · AdvancedDetection as Code
Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.
Architecture practice · IntermediateDetection by Design
Detection by design makes required telemetry, time integrity, identity context, sensor placement, retention, alerting, and investigation access explicit architecture requirements.
Detection platform · IntermediateEndpoint Detection and Response
Endpoint detection and response collects endpoint activity, identifies suspicious behavior, supports investigation, and provides response actions such as isolation or process termination.
Endpoint monitoring concept · AdvancedEndpoint Detection and Response Telemetry
EDR telemetry records endpoint behavior such as process execution, modules, files, registry, users, network connections, scripts, drivers, security events, and response actions so analysts can detect and investigate activity in context.
Investigative control · IntermediateEvidence Handling and Chain of Custody
Evidence handling protects the integrity, identity, context, and accountability of information collected during an investigation or legal process.
Detection terminology · FoundationalFalse Positives and False Negatives
False positives are benign events incorrectly classified as malicious, while false negatives are harmful events that a control or analytic fails to detect.
Government program · AdvancedFedRAMP
FedRAMP establishes security requirements and repeatable authorization processes for cloud services used by United States federal agencies.
Governance measurement practice · AdvancedGovernance Performance Management
Governance performance management measures whether governance structures, decisions, and processes are producing intended enterprise outcomes.
Detection concept · IntermediateIndicators of Compromise and Attack
Indicators of compromise describe evidence associated with a suspected intrusion, while indicators of attack emphasize behavior that may reveal an attack in progress.
Security data engineering concept · AdvancedLog Quality Engineering
Log quality engineering measures and improves whether security events are complete, accurate, timely, consistent, attributable, protected, and usable for the detections and investigations that depend on them.
Log governance · IntermediateLog Rotation and Retention
Log rotation and retention balance evidence needs, storage limits, privacy, performance, legal obligations, and reliable archival so important events remain available for the required period.
Security operations process · IntermediateLog Source Onboarding
Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.
Network monitoring concept · AdvancedNetwork Traffic Analysis
Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
Operational technology monitoring · AdvancedOT Log Collection Under Constraints
OT log collection under constraints prioritizes high-value security and operational evidence while respecting limited storage, bandwidth, device capability, vendor support, safety, and timing requirements.
Operational technology monitoring · AdvancedOT Network Monitoring Baselines
OT network monitoring baselines describe expected devices, peers, protocols, commands, direction, timing, volume, and maintenance behavior so meaningful deviations can be investigated.
Observability engineering · AdvancedObservability Correlation Identifiers
Observability correlation identifiers connect related logs, traces, metrics, events, jobs, users, changes, and requests across distributed automation.
Service management · IntermediatePCI File Integrity Monitoring
PCI file integrity monitoring detects unauthorized changes to critical system files, configuration files, content, and other security-relevant objects and routes meaningful alerts for investigation.
Operational technology security · AdvancedPLC Logic Change Monitoring
PLC logic change monitoring detects and verifies modifications to control logic, parameters, firmware, operating mode, and controller configuration against approved work.
Privacy engineering · AdvancedPrivacy Runtime Monitoring
Privacy runtime monitoring detects when deployed processing diverges from approved purpose, data scope, access, destination, retention, consent, or user-choice expectations.
Detection-program process · AdvancedSIEM Use-Case Lifecycle
The SIEM use-case lifecycle manages a detection from threat and business requirement through data validation, analytic design, testing, deployment, triage, measurement, tuning, maintenance, and retirement.
Hardening practice · IntermediateSOC Technology Hardening
SOC technology hardening protects the monitoring and response stack with least privilege, segmentation, secure configuration, audit logging, resilient access, and controlled administration.
Security telemetry · IntermediateSecure Logging Pipelines
Secure logging pipelines move events from producers through collection, transport, parsing, storage, and analysis while preserving integrity, timing, availability, context, and access control.
Security platform · IntermediateSecurity Information and Event Management
A SIEM centralizes selected security and operational data so teams can search, correlate, detect, investigate, report, and retain evidence across systems.
Operational practice · BeginnerSecurity Logging and Monitoring
Security logging records relevant activity, while monitoring evaluates that activity for conditions that require attention, investigation, or action.
Detection assurance practice · AdvancedSecurity Monitoring Coverage Validation
Monitoring coverage validation confirms that required events are generated, collected, parsed, retained, correlated, alerted, and investigated across the intended environment.
Security operations planning concept · IntermediateSecurity Telemetry Strategy
A security telemetry strategy defines which events, states, and contextual data an organization must collect to prevent, detect, investigate, respond to, and learn from priority threat and failure scenarios.
Operational monitoring · IntermediateServer Monitoring and Alerting
Server monitoring and alerting convert metrics, logs, events, health checks, and capacity trends into actionable notifications tied to service impact and response ownership.
Network detection concept · AdvancedSnort and Suricata Rules
Snort and Suricata rules describe network traffic conditions that an intrusion detection or prevention engine can alert on, record, reject, or otherwise handle using protocol, flow, content, metadata, and state-aware inspection.
Data preparation practice · IntermediateThreat Data Normalization
Threat data normalization converts inconsistent values, formats, timestamps, identifiers, and naming conventions into a common structure for analysis.
Proactive analysis · AdvancedThreat Hunting
Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.
Behavioral analytics concept · AdvancedUser and Entity Behavior Analytics
User and Entity Behavior Analytics models activity for users, devices, workloads, applications, and other entities to identify statistically or contextually unusual behavior that may indicate compromise, misuse, control failure, or operational change.
Malware detection concept · AdvancedYARA Rules
YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.