The Human in the Detection Loop: Building and Breaking AI Detection Pipelines
Live Class | The Human in the Detection Loop: Building and Breaking AI Detection Pipelines
Who this workshop is for:
Detection engineers and SOC analysts using AI to write or accelerate detection rules
Security practitioners who want to understand where AI-generated detections quietly fail
Anyone building or evaluating agentic AI pipelines for security use cases
What's included:
Live, hands-on session, build and break a real detection pipeline, not just watch a demo
Certificate of participation with CPE credits
Your AI just wrote a flawless detection in a few seconds. Clean syntax, textbook logic, mapped straight to the ATT&CK technique.
Ship it, right?
In this live, instructor-led workshop, you'll find out why that beautiful rule might be easily bypassed, or bury your analysts under a thousand false positives by lunchtime.
What makes this workshop different:
It's built around a real bypass and a real pipeline, not a slide deck on AI best practices
You'll see exactly where AI-generated detections break, before you build the fix
You leave with a working agentic pipeline architecture you can apply to real detections
What you'll learn:
Part 1: The Risks of AI-Generated Detections
False confidence: why a rule that reads as authoritative and complete isn't necessarily airtight
Watching an attacker slip straight past a "perfect" AI-generated rule
Why AI can't see your company context, your estate, your noise, your legitimate admin tooling
How that context gap turns a perfect-looking rule into a poor detection
Part 2: Building an Agentic Detection Pipeline
Designing a pipeline where one agent handles the research
Adding an agent that hunts specifically for false-positive risk
Checking detections against your environment's known-good behavior
A final validation agent that checks syntax before anything reaches production
Stress-testing the full pipeline with adversary emulation
Learn directly from:
Gabriel Novaes, Senior Content Engineer at TryHackMe
Recording notice: This event will be recorded. We may share the recording with registered attendees and may also use selected portions publicly, including on our website or social channels. By registering for and attending this event, you agree to this recording and use.