Response ownership and telemetry

I helped define responsibilities around Claroty alerts and OT Sentinel events, including who investigates, validates operational impact and carries out response. The wider monitoring discussions addressed identity and endpoint telemetry from the on-premises environment, evidence requirements and usable runbooks.