Detection Rules That Fire Once

Write, tune and validate detections against replayed attack traffic — and measure the false positive rate.

By Sentinel Labs

The brief

Write, tune and validate detections against replayed attack traffic — and measure the false positive rate. The brief is deliberately incomplete — you make and justify the tradeoffs.

Deliberately ambiguous — you make and justify the tradeoffs. Your work is checked against a held-out evaluation you can't see in advance.

Milestones & mentor checkpoints

How you're graded