Local worksheet · fictional scenario

Detection worksheet

Compare the signal with the expectation. A detection exercise is useful when its expected evidence is clear: record observations for this fictional scenario and export a local worksheet.

Why this matters. Coverage is only as good as the evidence behind each stage. The worksheet keeps missing telemetry and missing detection apart.

Key terms 5

Telemetry: Logs and events collected from systems, which detections and investigations depend on.
Detection rule: Logic that matches telemetry against a behaviour and raises an alert.
Triage: The first assessment of an alert, deciding whether and how to respond.
MITRE ATT&CK: A public knowledge base of adversary tactics and techniques, based on observed intrusions and organised by stage.
Sigma: An open, vendor-neutral format for detection rules that can be converted into the query languages of different SIEM platforms.

Read: The agents can attack. They cannot yet vouch for what they found.

A worksheet for a fictional exercise

These examples contain no client evidence. Changing an observation records your selection; it does not run a test or measure a real environment. Keep private system details out of the example notes.

Choose the exercise

Fictional validation scenario

Changing scenarios clears the current observations and notes.

A fictional administrator account receives an unexpected role in an agreed exercise.

Expected signal 01

Identity audit event

The role change is recorded with actor, target and timestamp.

Identity audit event observation

Expected signal 02

Detection alert

The relevant rule creates an alert with enough context for triage.

Detection alert observation

Expected signal 03

Response record

The exercise owner records the triage decision and next action.

Response record observation

Recorded observations

0 of 3 in-scope signals observed

Observed: 0
Gaps: 0
Unreviewed: 3
Out of scope: 0

This describes the selections in your fictional worksheet. Unreviewed signals remain unknown.

Exercise notes

Local notes only; 4,000 characters maximum. Describe the fictional evidence, gaps and next review step.