Notes on detection engineering methodology.
2026-09-07
Detection Rules That Know What They Need
Most rule catalogues tell you what to alert on. They rarely tell you whether your logs can actually produce the fields the rule depends on — or how to turn on the audit setting that does.