Engineer security detections — high-signal rules, telemetry requirements, testing, and tuning — as a product for responders. Use when building SIEM/EDR detections or reducing false positive load while improving true positive coverage.
