Quiz — DE Basics
10 APPLY items on detection-as-code, telemetry needs, and false positive cost on $PURPLE_LAB.
Detection Engineering Basics — Module Quiz
Ten APPLY items. Name DE concepts on YOUR $PURPLE_LAB — never unauthorized log collection, stranger-network sims, or untested production deploys. Original Cyberlium. Next: Sigma Named.
APPLY: Detection as code primarily means:
APPLY: True or False: Telemetry needs define required sources and fields before rules can fire.
APPLY: False positive cost includes:
APPLY: Tutorial collects logs from stranger systems without scope — you:
APPLY: DaC repo should include:
APPLY: Cyberlium NEVER allows:
APPLY: T1059 detection typically requires:
APPLY: True or False: Broad untested rules can cause alert storms.
APPLY: chmod 600 on DE notes means:
APPLY: Next lesson after this quiz: