Treating every Halcyon Energy detection as a testable hypothesis: a board heat map that claimed 71 percent ATT&CK coverage by counting rules, against validated weighted coverage that rose from 24 to 69 percent; the LSASS detection DET-0142 silently broken for 51 days by an EDR field change and an intrusion three detections should have caught; and the eight-step hypothesis staircase from hypothesis, data sources and logic review through test design, false positives and negatives, coverage and lifecycle to metrics, producing an assurance file of 212 hypotheses bound to 546 detections and decay fixed in 1.2 days instead of 47.

CY-EXPERT-049Expert Level · Detection Engineering

Detection Hypothesis Architecture Assurance — The Hypothesis Staircase

An expert-level course that treats every production detection as an explicit, testable hypothesis and assures it with evidence. Climb the hypothesis staircase - eight steps from a rule nobody can vouch for to an assured detection: threat-informed, falsifiable hypotheses in a register; data-source sufficiency with health SLOs; Sigma-based logic review and peer challenge; positive, negative, replay, and CI tests using benign own-lab simulations; precision, recall, and evidenced tuning; validated, priority-weighted coverage across layers; decay control with canaries and ownership; and assurance metrics, regulator evidence, and an optimised roadmap - while building the Halcyon Detection Assurance File for an energy trader answering a NIS2 regulator.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Turn threat intelligence and incidents into a prioritised register of falsifiable detection hypotheses carried in ADS documents.
Prove data-source sufficiency with field-level coverage, fill-rate, schema-drift, and health-SLO evidence, and challenge detection logic in Sigma-based peer review.
Test detections both ways with benign own-lab simulations, negative look-alikes, sanitised replay, and CI unit tests, then measure precision and recall and tune without going blind.
Publish validated, priority-weighted, layered coverage, control decay with tiered re-validation and canaries, and evidence effectiveness to a board and a NIS2 regulator with metrics and a costed roadmap.

Price:৳12,000