Lesson 2 of 15 · 5 min read
MITRE ATT&CK and Sigma: a Shared Language for Detections
MITRE ATT&CK is a knowledge base of adversary behaviour organised as tactics (goals) and techniques (how), now linked to detection strategies and the telemetry needed. Its 2026 releases split Defense Evasion into Stealth and Defense Impairment, giving Enterprise 15 tactics, and added AI-focused techniques. Sigma is a vendor-neutral rule format: a detection is written once in YAML and converted for each SIEM, with correlation rules for counts and sequences. Coverage means tested detections on collected data, not coloured cells.
free sign-in, no card required
Practise it as an interviewer asks it
Write a detection for a technique you care about. How do you choose data, write the logic, test it and keep false positives manageable?Design a detection-as-code programme: how are detections written, tested, reviewed, deployed and retired?How do you use MITRE ATT&CK to measure detection coverage, and how can a coverage heatmap mislead you?How do attack trees and kill chains help in threat modelling, and where do they mislead?What would you log for a new service, and how do you write a detection with an acceptable false-positive rate?Your SOC is drowning in alerts. How do you reduce alert fatigue, and which metrics tell you it is working?