SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM
SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM teaches detection engineers and SOC leads to develop, test, and manage custom detection rules and dashboards using CrowdStrike Query Language (CQL). It solves the critical challenge of building accurate, maintainable threat detection content in modern SOCs, where 74% of organizations report alert fatigue due to poorly tuned rules. Participants gain hands-on skills in MITRE ATT&CK-aligned detection engineering, custom dashboard creation, and rule lifecycle management within the Falcon platform.
This course prepares learners for the CrowdStrike Certified SIEM Engineer (CCSE) certification, validating expertise in detection rule development and security content management. With Koenig’s Guaranteed-to-Run scheduling and 30-day lab access, professionals gain flexible, hands-on practice to advance into roles like senior detection engineer or SOC architect, directly enhancing their organization’s threat visibility and response capabilities.
Training Formats & Pricing
Available in all languages Fastest
Available in all languages Most Popular
100% Happiness Guarantee · Free Rescheduling · Secure Payment
Course Overview
SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM by CrowdStrike is an instructor-led course designed for security professionals such as detection engineers, SOC leads, and security analysts responsible for developing and managing SIEM content. This course prepares learners for the CrowdStrike Certified SIEM Engineer (CCSE) certification, which validates expertise in implementing and managing Falcon Next-Gen SIEM. Participants will gain hands-on experience in building, testing, tuning, and deploying custom detection rules and dashboards, using the CrowdStrike Query Language (CQL) and MITRE ATT&CK framework to align detections with real-world threats. With 90% of Fortune 100 companies adopting CrowdStrike’s platform, this training equips professionals with in-demand skills to enhance organizational threat visibility and response capabilities.
The course emphasizes practical, hands-on learning through comprehensive exercises in the Falcon Encounter training environment. Students will work directly with key CrowdStrike technologies including Falcon Next-Gen SIEM, CQL, MITRE ATT&CK, LogScale, Foundry, and behavioral correlation rules. During lab sessions, participants build a complete security visibility practice by constructing custom correlation rules from scratch, configuring interactive dashboards with query-powered widgets, and generating automated reports. A capstone project challenges learners to design a tailored dashboard that visualizes threat data and integrates scheduled workflows, simulating real-world scenarios such as detecting suspicious DNS activity or unauthorized process execution across endpoints.
Completing SIEM 220 prepares candidates for the CCSE certification, a recognized credential that demonstrates mastery in Falcon Next-Gen SIEM implementation and management. Certified professionals are in high demand, with roles like SIEM Resident Consultant commanding base salaries between $115,000 and $160,000 annually. Koenig Solutions supports learners with official CrowdStrike courseware, expert-led instruction, and a Guaranteed-to-Run schedule, ensuring access to up-to-date, vendor-authorized content. By mastering detection engineering and dashboard development in Falcon Next-Gen SIEM, graduates are well-positioned to lead advanced security operations and drive measurable improvements in threat detection and response.
What You'll Learn
Skills You'll Gain
Prerequisites
- CQL 101: CrowdStrike Query Language Fundamentals 1 or equivalent experience in Falcon SIEM query development
- CQL 102: CrowdStrike Query Language Fundamentals 2 or similar experience with Falcon SIEM query scripting
- CQL 201: Designing and Optimizing CQL Queries or proven CQL skills for Falcon SIEM optimization
- SIEM 100: Next-Gen SIEM Fundamentals or foundational knowledge of CrowdStrike Falcon SIEM platform
- Hands-on experience with the MITRE ATT&CK® framework for threat detection in Falcon SIEM environments
- Familiarity with the Falcon Platform interface and navigation for efficient security operations
What's Included in Your Training
Every enrollment comes packed with resources to maximise your learning and exam success
Exam Preparation Materials
Practice Test Questions (200+)
Certificate of Completion
Post-Training Support (30 days)
Session Recording Access
Free Rescheduling (7+ days notice)
Career Outcomes
of SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM certified professionals report career advancement within 6 months
Salary Impact
Average salary increase reported after obtaining the SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM certification
*Source: Glassdoor / LinkedIn 2025
Job Roles
- SIEM Engineer
- Detection Engineer
- SOC Lead
- Security Operations Analyst
- Threat Detection Specialist
- Security Content Developer
Companies Hiring
and 5,000+ organizations worldwide seeking SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM certified professionals
Course Student Reviews
Real results from IT professionals who trained with Koenig — rated 4.9/5 from 18,400+ verified reviews.
-
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified -
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified -
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified -
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified -
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified -
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified
-
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified -
★★★★★
“Passed AZ-104 on first attempt. The MCT knew the exact exam patterns and the labs were exactly what Microsoft tests. Worth every penny.”
AZ-104 Certified ✓ Verified -
★★★★★
“I trained 15 of my team members for SC-200. Koenig's on-site delivery was seamless and all 15 passed within 3 months.”
Enterprise Client ✓ Verified -
★★★★★
“The 1-on-1 format was a game changer. My trainer adjusted the pace to my schedule and I cleared PL-300 while working full-time.”
PL-300 Certified ✓ Verified
-
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified -
★★★★★
“From AZ-900 to AZ-305 in 6 months. Koenig's structured roadmap and MCT mentoring made the expert level achievable.”
AZ-305 Expert ✓ Verified -
★★★★★
“As an L&D head I've used 5 training vendors. Koenig's MCT quality, MOC materials, and ESI compliance is in a different league.”
100+ Learners Trained ✓ Verified -
★★★★★
“SC-900 and SC-300 back to back — both cleared first try. The security curriculum at Koenig is incredibly thorough and up to date.”
SC-300 Certified ✓ Verified
-
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified -
★★★★★
“AI-102 was daunting but the trainer broke it down perfectly. Real Azure OpenAI labs made the difference. Highly recommend.”
AI-102 Certified ✓ Verified -
★★★★★
“DP-600 Fabric certification done in 3 weeks of part-time study. The customised schedule around my timezone was a lifesaver.”
DP-600 Certified ✓ Verified -
★★★★★
“Our whole DevOps team got AZ-400 certified through Koenig's corporate training. Smooth logistics and top-tier MCTs throughout.”
AZ-400 Team Training ✓ Verified
Frequently Asked Questions
Everything you need to know about the SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM training course
Is the certification exam included in SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM training, and what is the exam fee if separate?
What delivery modes does Koenig offer for SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM, including scheduling guarantees?
How long is lab access provided for SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM, and what environment is used?
What is Koenig's rescheduling and cancellation policy for SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM?
What is the exam format, question count, passing score, and time limit for the related CrowdStrike SIEM certification?
How long is the CrowdStrike SIEM certification valid, and what is the renewal process and cost?
What post-training support does Koenig provide after SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM completion?
What prerequisites or experience are needed for SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM?
How does completing SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM impact career prospects in SIEM roles?
How does SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM compare to self-study for mastering Falcon Next-Gen SIEM detections?
Still have questions?
Chat with a Training Advisor →COURSES RELATED TO SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM
Resources
Learn more about SIEM 220: Building Detection Rules and Dashboards in Falcon Next-Gen SIEM before you enroll
Understanding the Basics of Siemens PLC Programming
In the ever-evolving realm of the industrial automation industry, Siemens PLC programming basics have gained significant importance. Siemens…
Read GuideSiemens PLC Course | TIA Portal Advanced PLC Programming Training
Siemens PLC Programming using the TIA Portal has become a necessity in the modern automation industry. This advanced software offers a range…
Read ArticleSiemens TIA Portal Training: Master Siemens PLC Programming Course
In the modern age of automation and smart factories, Programmable Logic Controllers (PLCs) have become an indispensable part of industrial a…
Read ArticleHappiness Guarantee
We are so confident in the quality of our training that we offer a full money-back guarantee. Not satisfied? Contact us within 24 hours of your first session — we'll refund you completely, no questions asked.