Incident › Module 9 › Lesson 3
Detection Gaps
Detection gap literacy — missed signals, rule uplift, logging gaps, hunt hypotheses — gap rows on YOUR `$IR_LAB` tabletop linked to lessons learned.
Visual · t34_detection_gaps
Detection gaps = named uplift rows. $IR_LAB. Original Cyberlium.
Opening
Every incident reveals detection debt — name gap and uplift rows on YOUR lab tabletop before pushing unauthorized prod SIEM rules.
Detection gap literacy names: missed alert or log source category, detection rule uplift category, logging coverage gap category, hunt hypothesis for recurrence category, and metrics/monitoring KPI stub category. Analyst documents detection gap register on `$IR_LAB` tabletop — three gaps with proposed uplift stub and validation plan literacy — without deploying unauthorized prod SIEM rules, without claiming gaps fixed without test, without offensive repro to 'generate alerts.' Cyberlium links Module 4 detection literacy to post-incident improvement — YOUR notes. Refused: unauthorized prod rule deploy, alert flooding prod, attack repro for detection. Lab row: detection gap register (three gaps, uplift stub, validation plan).
1. Named gap rows
Missed signal, rule uplift, logging gap, hunt hypothesis, KPI stub — five literacy anchors.
Each gap links to lessons learned row from 9-1 — same incident thread.
Command guide
Try these commands — Named gap rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final CISA — https://www.cisa.gov/stopransomware SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/post-incident/detection-gaps-checklist.md" <<'EOF'
# Detection Gaps Checklist — post-incident
- [ ] Could SOC have detected earlier? Which rule was missing?
- [ ] Were backups monitored for tam/disable alerts?
- [ ] Was EDR coverage complete on affected segment?
- [ ] Did severity matrix trigger correct escalation?
- [ ] Were playbooks current and followed?
- [ ] Tabletop frequency adequate?
- [ ] Map gaps to MITRE ATT&CK techniques for detection engineering backlog
Feed results into lessons-learned action items
EOFCommand — copy this
grep '\[ \]' "$IR_LAB/post-incident/detection-gaps-checklist.md"
python3 -c "print('Detection gaps: SOC rules + EDR coverage + playbook adherence')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA (https://www.cisa.gov/stopransomware); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Uplift discipline
Proposed detection change includes validation plan stub — lab or ticket path literacy.
Avoid alert noise — document false-positive risk category on stub.
3. Refused
No unauthorized prod SIEM deploy; no attack repro to generate alerts.
Gap literacy supports detection maturity — not unauthorized tooling changes.
4. What you ship: detection gap register
Three gaps + uplift stub + validation plan + NEVER unauthorized prod rule deploy line.
5. What you record before the next lesson
Detection gap register path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Push unvalidated detection rules to employer prod SIEM from lab gap register without ticket.
Right
Detection gap register from `$IR_LAB` tabletop stub. Next: PIR Lab.
Mission: detection gap register
1) Name five detection gap rows. 2) Three gaps from tabletop timeline. 3) Uplift stub and validation plan each. 4) Write NEVER unauthorized prod rule deploy line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Validation plan — lab vs ticket path literacy?”
Knowledge Check
APPLY: Detection gap literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized prod rule deploy is gap lab.
True or False
Knowledge Check
APPLY: Detection gaps include:
Multiple choice