This hands-on workshop guides participants through the detection engineering lifecycle using real Windows telemetry, live attacks, and Elastic Cloud. You’ll configure Sysmon, simulate attacks using tools like Metasploit, and write custom detections based on real data. Whether you’re a SOC analyst or security engineer, this lab-focused session will help you move from raw telemetry to actionable detections
Student Requirements
Internet Access
Ability to create a free Elastic Cloud trial account (email is required).
Basic comfort with navigating Windows and Linux systems
VM/Lab/Student information
A system with a browser and solid internet connection
The ability to register via MetaCTF. Attendees will have access to the course VM and Labs via the MetaCTF platform for the duration of the workshop.
Hal Denton is a Security Analyst specializing in detection engineering, DFIR, threat hunting and CTI. With experience covering several facets of IT and InfoSec for over 20 years, Hal is committed in making the Blue Team struggles more bearable and provide a gateway for the future generation of InfoSec professionals. Hal has a BS in Computer Forensics and Digital Investigations.