i want to learn Threat Detection/ Detection engineering.

Is it worth investing time in learning how to write custom Snort rules from scratch, or is it better to spend my time on something else and just update published rules if i were to work as an analyst?

Aside from Snort, Splunk, and basic rule writing, what other skills or tools should I prioritize learning to become a proficient detection engineer? I've heard about forensics (network and memory analysis), YARA, Sigma, and the ELK stack—how important are these in practical settings?

I'm open to any advice, recommendations, or personal experiences you can share. Whether you're a seasoned cybersecurity professional or a fellow enthusiast, I'd greatly appreciate your insights.

Thank you in advance for your help! submitted by /u/Recent_End964
[link] [comments]


http://dlvr.it/T4pKVR