Detection Engineer
Follow this curated learning path to design, build, and refine detection logic as a Detection Engineer.
These seven courses take you from the fundamentals of Cloud SIEM and log management through writing and enhancing custom detection rules and automating the response to the threats they surface. Engage in hands-on practice within live demo environments to gain experience analyzing real-time data using a free Datadog trial account.
This path is designed specifically for Detection Engineers and other roles responsible for designing, building, and continuously improving detection logic across the security stack.
You’ll learn how to do the following:
Introduction to Cloud SIEM
Get started with Datadog Cloud SIEM. Learn how Cloud SIEM detects threats, supports investigation workflows, and helps teams maintain strong security operations. Investigate threats in a real cloud environment.
Getting Started with Log Explorer
Query logs from all of your log sources. Investigate log details. Build visualizations with Fields Aggregations. Create Saved Views. Add facets and measures.
Dive Deeper into Log Queries and Aggregations
Create visualizations for counts and statistics of log attributes. Build multiple queries and formulas. Use functions to transform data in visualizations. Aggregate logs based on patterns and transactions (related sequences of events).
Write Custom Cloud SIEM Detection Rules
Create custom detection rules for Datadog Cloud SIEM. Write detection rule queries using key log attributes and create notification rules to automatically alert stakeholders. Write suppression queries and manage detection rules as code.
Enhance Log Querying and Analytics with Reference Tables, Subqueries, and Calculated Fields
Combine metadata with your logs using Reference Tables. Filter one set of logs against another set of logs using Subqueries. Create new fields using existing tags and attributes at query time using Calculated Fields.
Detect and Investigate Threats with Cloud SIEM
Secure your cloud environments with Datadog Cloud SIEM and cloud provider Content Packs. Explore out-of-the-box threat detection rules. Investigate incoming threats using Security Signals, Signals Explorer, and Cloud SIEM Investigator.
Automate Threat Investigation and Remediation with Security Workflows
Automate security investigation and remediation tasks with Datadog Workflow Automation and Cloud SIEM. Create security workflows using Cloud SIEM Content Packs and SOAR blueprints. Automate threat remediation in AWS using security workflows.
