PURPLE TEAM DETECTION ENGINEERINGBuild detections you can test, explain, and improve.

Build a local purple team lab, emulate adversary behavior, and develop Sigma and Elastic detections. Bring the workflow together in a web-application capstone: investigate the activity, test a detection, and document your findings.

For aspiring SOC analysts and IT or security practitioners with basic networking and command-line skills.

Learn it. Apply it. Keep the evidence.

12 modules · Written lessons and hands-on lab work · Local virtual lab

LIMITED TIME - FOUNDERS EDITION

Build practical detection-engineering skills through written lessons, lab exercises, and a repeatable workflow from hypothesis to investigation.

Lifetime access · all future updates included

Build a body of work you can explain.

Move beyond recognizing a technique. Practice documenting the evidence, testing your detection, and explaining what the result means.

01 · DEVELOP

Detection rules and test records

Develop Sigma and Elastic detections. Record what fires, what stays quiet, and where coverage needs more work.

02 · INVESTIGATE

A capstone investigation

Work through a vulnerable web-application scenario. Connect evidence to searches, a detection, and an analyst handoff.

03 · IMPROVE

A repeatable purple team workflow

Learn to prioritize detection work, track coverage, and plan the next cycle of testing and improvement.

The aim is work you can review and improve: your reasoning, your test results, and the limits you can identify.

One workflow. Four stages of progress.

Build the foundations, work with telemetry, and bring the pieces together in a capstone. Explore the full lesson list below.

01 · MODULES 1–2

Understand the workflow

Connect adversary behavior to observable evidence. Start with a detection hypothesis you can refine as your skills develop.

02 · MODULES 3–4

Build and instrument your lab

Set up a segmented virtual lab and the telemetry you will use to investigate activity.

03 · MODULES 5–9

Emulate, detect and validate

Practice across Windows and Active Directory techniques. Develop detections, test benign activity and variants, and document gaps.

04 · MODULES 10–12

Operationalize and demonstrate your work

Connect detection engineering to a repeatable program, then investigate a web-application scenario in the capstone.

Your first detection hypothesis

Free sample · No signup or lab required

Try the reasoning before you build the lab. This fictional scenario is a short exercise in asking better questions about security evidence.

The scenario

A fictional organization records 3 failed sign-ins for an account, followed by a successful sign-in from a device it has not previously recorded for that account. This could be legitimate activity or account misuse. These details alone do not establish which.

Write 4 lines in your own notes:

  1. What behavior would you investigate?
  2. Which records would you inspect?
  3. What additional evidence would make the activity more concerning?
  4. What legitimate explanation would you test?
Compare with an example answer

Investigate whether the successful sign-in was expected. Compare authentication records, device history and the user's usual activity. Look for changes in context and follow-on actions. Check whether the user was setting up a new device or correcting a mistyped password. Record what remains unknown.

A useful hypothesis names the evidence you need and the alternative explanation you will check. In the course, you apply that reasoning to telemetry and testable detections.

Explore the learning path

What you’ll learn

What your machine needs

RAM32 GB minimum · 64 GB recommendedFree disk space256 GB SSD minimum · 512 GB NVMe recommendedCPU6 cores / 12 threads minimum
8+ cores / 16 threads recommended
VT-x / AMD-V enabledHost OSWindows, 64-bitVirtualizationVMware Workstation Pro (Personal license)You'll runKali Linux · Active Directory ·
DVWA · Elastic StackApple Silicon (M1–M4): Windows Server 2025 isn't compatible with ARM CPUs and will not work,  so the lab needs an x86-64 machine.

What you need to know

✓Comfortable in a terminal — you can move around a Linux shell✓Networking fundamentals — IP addresses, ports, DNS✓Willingness to break things and fix them — you troubleshoot your own lab

What you don't need

✕Paid tools or licenses — every tool in the lab is free✕Cloud spend — it all runs on your own machine✕A home server or dedicated hardware✕Prior detection engineering experienceYou do not need to be an expert to start.

Your instructor

JF Provost

Founder & CEO, Malvik Security
11+ years teachingCanadian Armed Forces veteranOSCPSIEM work since 2018

JF has more than 11 years of instructional experience. Six of those years were in the Canadian Armed Forces, where he taught, built courseware and evaluated operator readiness.

Since 2018 he has worked hands-on in security operations, first as an analyst in a 24/7 SOC, then as a senior SIEM consultant to government security teams, across QRadar, ArcSight, Splunk, Microsoft Sentinel and Elastic. He holds the OSCP, so he knows the attack side as well as the defense, and he leads the Defenders Village at BSides Ottawa.

He built this course the way he teaches: you run the attack, find what it left behind, write the detection, and test it until it holds. By the end, you should be able to explain your work well enough for another analyst to reproduce it.

Is this the right course for you?

This course is for aspiring SOC analysts and IT or security practitioners who want to develop practical detection-engineering skills. Bring basic networking knowledge, comfort with a terminal, and a willingness to build and troubleshoot your lab.

What should I know before starting?

You should be comfortable with IP addressing, DNS and basic terminal commands. You will build and troubleshoot a local virtual lab as you work through the course.

How is the course taught?

The current course uses written lessons and hands-on lab work. Read the explanation, apply the steps, and keep evidence of what you observe.

What computer do I need?

The lab uses a 64-bit Windows host with an x86-64 processor and virtualization support. The full lab needs at least 32 GB of RAM, and 64 GB is recommended. A 16 GB host can only run reduced demonstrations, not the full lab. Review the hardware requirements before setting up your lab.

How much time should I set aside?

Plan separate sessions for reading, lab setup and testing. Installation and troubleshooting add time beyond the lesson text, and some validation work includes observation between sessions.

What will I practice?

You will work through a cycle of hypothesis, emulation, telemetry, detection and validation. The course covers Windows and Active Directory techniques and brings the workflow together in a web-application capstone.

What does success look like?

You can explain the behavior you investigated, the evidence you used, the tests you ran, and what your detection may still miss.

Build the lab. Test the detection. Explain the result.

Develop practical detection-engineering skills through a structured path from your first hypothesis to a capstone investigation.

Enroll in the course Try the sample first
Malvik Security