An alert fires, a DNS lookup goes somewhere nobody recognises, and you have minutes to decide what it is. Ten objectives, none of them weighted, and a price that makes the first attempt matter.
GIAC GSOC Certification: Ten Objectives, No Weightings
SIEM
Splunk SPLK-5002 Detection Engineering Exam Guide
A domain-by-domain guide to the Splunk SPLK-5002 Detection Engineering exam: data normalisation, correlation-search tuning, risk-based alerting, the detection lifecycle, SOAR automation, and metrics.
