> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/readme.md).

# README

A working knowledge base built while studying **TCM Security — Detection Engineering for Beginners** (instructor: Anthony Isherwood), written to the standard defined in [Note-Taking Standard](broken://pages/28f9a000c99d2b8a9ccb58770e3faedf4f7a7384).

These are not summaries. Each section is written to be complete enough that the original video, slide, or documentation never needs to be revisited.

## Start here

Before Part 1, read the [**Course Reference & Detection-as-Code Architecture**](broken://pages/faea9b510ff38567c8c25289bd8fbd684ef8fdf4) — it maps the whole course, explains why each tool exists, and describes the single pipeline (`attack → telemetry → rule → validate → deploy → measure`) that every module builds toward.

## How this is organised

| Part                                                                                             | Contents                                                                                        |
| ------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------- |
| [1. Introduction, Theory & Lab Setup](broken://pages/ae2048895c29a5ed3bc471a1a063616741749379)   | Security operations theory, the detection engineering lifecycle, and the VirtualBox/Elastic lab |
| [2. Elastic Setup](broken://pages/f3acfa2bc9b35a2807f893b1aff7ed8b20d9b013)                      | Elastic Agent, confirming Sysmon/Zeek telemetry, PowerShell visibility                          |
| [3. Attack Scenarios & Atomic Red Team](broken://pages/eb4c11b1c9c07081ce9c165e71d39167d153be88) | Three attacks, a detection per scenario, and Atomic Red Team                                    |
| [4. TOML & Detection-as-Code](broken://pages/3a2274369e9fa3e0eca7dea2017585786e7476a5)           | Rules as TOML, the enforced schema, MITRE objects, validation                                   |
| [5. Elastic API, GitHub & Metrics](broken://pages/f961baa40304dc85f571d841950b2c9c2211a651)      | API rule sync, GitHub Actions CI/CD, coverage metrics                                           |

## The stack

VirtualBox · Elastic (Elasticsearch + Kibana) · Elastic Agent · Sysmon · Zeek · Atomic Red Team · Python · TOML · GitHub Actions · MITRE ATT\&CK.

## Section numbering

Sections are numbered `<part>.<n>` (e.g. `1.1`, `1.2`, `2.1`) and always sit at heading level `##`. All sub-headings inside a section start at `###`.