I’m looking for training that measurably improves detection quality, not just a certificate. In Q4 we ran a 6-week ATT&CK-aligned lab using Sigma and Jupyter to tune T1059/T1071 detections and cut false positives by 11%; if you’ve taken SANS FOR578 or similar, did you see quantifiable deltas in MTTD or precision afterward?
FOR578 sharpened our intel packaging, but it didn’t move MTTD much; SEC555 drove detection gains for us (, naming). After SEC555 we set up weekly Atomic Red Team runs for T1059/T1071 and tracked pre/post alert precision in Jupyter with Sigma, which gave us a steady about 9% precision bump over a quarter; concrete step: bake those runs into CI and auto-fail on drift. If you want measurable deltas, wire GitHub - redcanaryco/atomic-red-team: Small and highly portable detection tests based on MITRE's ATT&CK. into your Sigma test harness — have you tried that?
Adding one data point: SEC555 was solid, but MITRE ATT&CK Defender’s AEDE pushed our precision more — forcing us to “state the detection hypothesis” and keep a small null set let us tighten T1059/T1071 with parent/child and cmdline anchors, cutting FPs about 10% and trimming MTTD about 15% (@tpeterson71 was on the right track about hands-on). Would you baseline a week of known-good before you retrain the rules?