QA Pro AcademyCybersecurity A-Z
Join free
← Back to catalogue
Programme LITMUS at Westmere National Insurance: a test harness firing benign simulated telemetry down eight detection lanes, from endpoint and identity to the OT boundary and insider data movement, each lane showing rules passing, failing and still untested; the trigger, three rules that never fired during a 71-day intrusion because a log source stopped, a field name broke in a schema change and a rule was disabled for noise; and tested-and-passing coverage rising from 59 of 1,240 rules to 803 of 1,016, 79% against a 70% target, with silent rules cut from 410 to 48, for the Board on 24 February 2027.
CY-PRO-070Pro Level · Detection Engineering

Detection Rule Validation and Coverage

Prove your detections fire — before the next incident proves they don't.

40 hours12 chapters60 lessons433 activities12 labs

What you'll learn

  • Define and measure detection assurance honestly — tested-and-passing coverage by category and tier, silent rules and log-source health — and contain the failures behind an incident narrowly and verifiably.
  • Build the machinery that keeps detections proven — a safe production test harness, data contracts and health alerts, detection-as-code with review and rollback, and regression triggered by upstream change.
  • Run detection recovery under a deadline — triage by consequence, tuning without muting, expiring disablements and suppressions, and early warnings with forecast ranges.
  • Report numbers a Board, a regulator and an auditor can re-compute, price a sustainable model at the margin, define residuals within appetite and win a resolution everyone can be held to.
Price:৳15,000
Sign in to get access

Sign in to enrol — you can pay by bKash or Nagad, or apply a promo code.