Incident › Module 9 › Lesson 3
Detection Gaps
Detection gap literacy — missed signals, rule uplift, logging gaps, hunt hypotheses — gap rows on YOUR `$IR_LAB` tabletop linked to lessons learned.
Visual · t34_detection_gaps
Detection gaps = named uplift rows. $IR_LAB. Original Cyberlium.
Opening
Every incident reveals detection debt — name gap and uplift rows on YOUR lab tabletop before pushing unauthorized prod SIEM rules.
Detection gap literacy names: missed alert or log source category, detection rule uplift category, logging coverage gap category, hunt hypothesis for recurrence category, and metrics/monitoring KPI stub category. Analyst documents detection gap register on `$IR_LAB` tabletop — three gaps with proposed uplift stub and validation plan literacy — without deploying unauthorized prod SIEM rules, without claiming gaps fixed without test, without offensive repro to 'generate alerts.' Cyberlium links Module 4 detection literacy to post-incident improvement — YOUR notes. Refused: unauthorized prod rule deploy, alert flooding prod, attack repro for detection. Lab row: detection gap register (three gaps, uplift stub, validation plan).
1. Named gap rows
Missed signal, rule uplift, logging gap, hunt hypothesis, KPI stub — five literacy anchors.
Each gap links to lessons learned row from 9-1 — same incident thread.
Command guide
Try these commands — Named gap rows
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: grep, python3. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); CISA (https://www.cisa.gov/stopransomware); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Uplift discipline
Proposed detection change includes validation plan stub — lab or ticket path literacy.
Avoid alert noise — document false-positive risk category on stub.
3. Refused
No unauthorized prod SIEM deploy; no attack repro to generate alerts.
Gap literacy supports detection maturity — not unauthorized tooling changes.
4. What you ship: detection gap register
Three gaps + uplift stub + validation plan + NEVER unauthorized prod rule deploy line.
5. What you record before the next lesson
Detection gap register path.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Push unvalidated detection rules to employer prod SIEM from lab gap register without ticket.
Right
Detection gap register from `$IR_LAB` tabletop stub. Next: PIR Lab.
Mission: detection gap register
1) Name five detection gap rows. 2) Three gaps from tabletop timeline. 3) Uplift stub and validation plan each. 4) Write NEVER unauthorized prod rule deploy line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Validation plan — lab vs ticket path literacy?”
Knowledge Check
APPLY: Detection gap literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized prod rule deploy is gap lab.
True or False
Knowledge Check
APPLY: Detection gaps include:
Multiple choice