[mndtrcks]

Summary

Proposed structure for Core Module 04 Detection Design, completing the research defined in #13.

• core/04-detection-design/README.md: module learning objectives, prerequisites, eight proposed lessons (each with learning objectives, key topics, and out of scope), a Boundaries section, and references.
• core/04-detection-design/module-metadata.yml: status: draft.

Lessons:

1. Researching the Behavior
2. Detection Hypotheses
3. Choosing a Detection Approach
4. ATT&CK Mapping & Coverage Analysis
5. Pseudocode
6. Pre-Mortem
7. Alert & Response Design
8. Documenting & Reviewing a Design

Related Issue

Closes #13

Contribution Type

• Core curriculum
• Domain track
• Platform track
• Advanced track
• Lab
• Dataset
• Documentation
• Governance / project maintenance

Validation

• I understand and can defend the technical content in this contribution.
• I verified technical claims, examples, and references.
• This contribution is substantially my own work.
• This contribution does not contain proprietary, confidential, or improperly licensed material.
• I reviewed the relevant contribution guidelines.
• All commits are signed off (git commit -s) per the DCO.

Review Requested

What kind of review would be most useful?

• Technical accuracy
• Operational realism
• Curriculum structure
• Instructional quality
• Vendor neutrality
• Lab / dataset validation
• General review

Affiliations / Conflicts

None.

Additional Context

Boundaries align with the merged 01, 02, and 03 READMEs.