Sample questions
Bt Detection Engineering TuningDifficulty 1
In the simplest terms, what is a detection rule in a SOC's monitoring stack?
- aA document listing every employee's login credentials for audit purposes.
- bA defined pattern or logic that, when matched against logs or files, triggers an alert for analyst review.✓
- cA firewall configuration that blocks all inbound traffic regardless of source, which is a network control mechanism rather than something that observes and flags suspicious activity for review.
- dA contract clause describing how long backups must be retained.
Explanation:A detection rule encodes a pattern (a specific event sequence, field value, or file characteristic) that the monitoring platform evaluates continuously; when the pattern matches, it generates an alert for a human or automated workflow to triage.
Bt Detection Engineering TuningDifficulty 1
A rule fires an alert for activity that is later confirmed to be completely benign. What is this outcome called?
- aA false positive — the rule matched, but there was no actual malicious or policy-violating activity.✓
- bA true negative, because the analyst eventually closed the ticket without escalation, which shows the underlying activity was correctly judged to require no further action.
- cA zero-day, because the activity had never been observed by the organization before.
- dA containment failure, because the workstation was not isolated immediately.
Explanation:A false positive is an alert that fires without a genuine underlying incident. It differs from a true negative (no alert, no incident) and has nothing inherently to do with novelty or containment actions.
Bt Detection Engineering TuningDifficulty 2
A detection rule fails to trigger during an actual intrusion that later gets discovered through other means. What is this missed detection called, and why is it dangerous?
- aA true positive, because the intrusion was eventually discovered by any method available, regardless of whether the rule that was specifically built to catch it ever actually fired.
- bA tuning success, since the analyst workload for that period stayed low.
- cAn escalation, because the incident was handled outside normal triage.
- dA false negative — the rule stayed silent during real malicious activity, so the attacker's dwell time increases undetected.✓
Explanation:A false negative means genuine malicious activity occurred but no alert fired. It is often more dangerous than a false positive because it directly extends attacker dwell time and delays containment.
Bt Detection Engineering TuningDifficulty 1
Sigma is widely used in detection engineering as a shared rule format. What is its main purpose?
- aIt replaces the need for a SIEM entirely, running detections directly on network cables, eliminating any requirement to collect, store, or query log data at all.
- bIt is a generic, vendor-agnostic way to describe log-based detection logic so it can be translated into different SIEM query languages.✓
- cIt only works for detecting malicious files stored on disk, not log events.
- dIt is a malware family, and Sigma rules describe how to remove it from infected hosts.
Explanation:Sigma is a community detection-rule format for log-based analytics: an analyst writes the logic once, and it can be translated/converted for various SIEM backends, instead of writing the same detection in each vendor's native query syntax from scratch.
Bt Detection Engineering TuningDifficulty 1
YARA is another common tool in detection engineering. What kind of detection is it primarily designed for?
- aIdentifying files or in-memory content that match defined patterns, such as strings or structural characteristics associated with malware.✓
- bCorrelating login events across multiple identity providers over a rolling 24-hour window, which depends on structured authentication log data rather than raw file or memory content.
- cBlocking outbound network connections based solely on destination country.
- dGenerating executive dashboards that summarize quarterly compliance posture.
Explanation:YARA is a pattern-matching tool oriented at files and memory content — it describes strings, byte patterns, or structural conditions that identify malware families or suspicious artifacts, rather than correlating log events across systems.
Bt Detection Engineering TuningDifficulty 2
How would you summarize the core difference between Sigma and YARA in a detection engineering context?
- aSigma requires a paid license from a single vendor, while YARA is a proprietary format with no community adoption, so neither is suitable for open, cross-organization sharing of detection content.
- bSigma and YARA are interchangeable names for the exact same rule syntax used by every SIEM vendor.
- cSigma only detects network intrusions, while YARA only detects insider threats through HR records.
- dSigma expresses detection logic over structured log events, while YARA expresses pattern matching over files or memory content.✓
Explanation:The practical distinction is the data they operate on: Sigma targets structured log/event data (e.g., authentication logs, process creation events) translated to SIEM queries, while YARA targets raw files or memory buffers for byte/string pattern matches.