Advanced Purple Teaming and Detection Engineering
Emulation only matters if it changes what you can detect. This advanced purple teaming course runs the tight loop between adversary emulation and detection engineering: you reproduce real threat actor techniques, measure your coverage honestly, then build and validate the detections you are missing.
You work against a monitored lab under written authorization, and you leave able to turn a piece of threat intelligence into a tested, tuned detection that fires on the behaviour that matters.
- Duration
- 10 weeks
- Format
- Live online, instructor-led
- Prerequisites
- Purple Team Tactics and Kill Chain Defences
- Class size
- Capped at 12 learners
What you will be able to do
- Turn a threat intelligence report into a repeatable emulation plan
- Emulate real threat actor techniques safely in a monitored lab
- Define and measure detection coverage in testable terms
- Engineer new detections for the techniques you cannot yet see
- Tune detections for signal rather than noise and validate them
- Manage detection content as code with automated testing
- Report measurable detection improvement to leadership
Course outline
6 modules
- Turning threat reports into test plans
- Selecting techniques that matter to you
- Building safe, repeatable emulations
- Mapping emulation to MITRE ATT&CK
What you need before you start
- Completion of Purple Team Tactics and Kill Chain Defences
- Working detection or SIEM engineering experience
- Comfort with a query language and version control
- Familiarity with MITRE ATT&CK and threat reporting
Who this course is for
- Detection engineers who want a rigorous emulation loop
- Purple teamers formalising coverage measurement
- SOC leads investing in threat-informed defence
- Analysts preparing for the CompTIA CySA+ exam
Where this leads
Prepares you for
CySA+
Awarded by CompTIA
CompTIA issues the CySA+ certification on passing its exam, not the academy. The detection engineering, analytics and threat-informed defence practised in this course reinforce the behavioural detection and response skills that CySA+ assesses.
Questions about this course
More in offensive security
CoreHacker Tools, Techniques and Incident Handling
Learn attacker tools and techniques from the defender's chair, then run a structured incident handling process, in a live online course from Toronto.
8 weeks · live online
Contact for pricingView outline
CoreWeb Application Penetration Testing
Hands-on web application penetration testing course that takes you from reconnaissance through exploitation and reporting, using the OWASP Top 10 and beyond.
8 weeks · live online
Contact for pricingView outline
CoreIoT Penetration Testing
An IoT penetration testing course covering firmware extraction and analysis, radio protocols, and the cloud and mobile backends behind connected devices.
8 weeks · live online
Contact for pricingView outline
Ready to launch your cyber security career?
Join the next live online cohort. No experience required, just bring the curiosity.