Trying to understand threat detection engineering.

So I have been tasked with creating siem and edr rules. However I am finding it diffucult to do what i would call a true value add.


We use windows defender + edr.
We use all of AWS security services
We have siem + soar
We use pulses and feeds for live IOC


I find it difficult to add rules other than for trending/new threats and internal policy violations. Any books, courses, materials I can try would be super nice. …

aws call cybersecurity defender detection detection engineering edr engineering ioc live rules security security services services siem soar threat threat detection threat detection engineering understand value windows windows defender