> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering.md).

# Detection engineering

- [00 course reference](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/00-course-reference.md)
- [00 notes skill](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/00-notes-skill.md)
- [01 intro and lab setup](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/01-intro-and-lab-setup.md)
- [02 elastic setup](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/02-elastic-setup.md)
- [03 attack scenarios](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/03-attack-scenarios.md)
- [04 toml](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/04-toml.md)
- [05 elastic api metrics](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/05-elastic-api-metrics.md)
- [README](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/readme.md)
- [SUMMARY](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/summary.md)