The delivered Use Case Pipeline defines justification, source-log prerequisites, KQL implementation, logic review, release and tuning, followed by a test trigger and deeper analysis. Priorities and named owners make both new detections and tuning requests actionable. I also contributed to the repository of versioned Sentinel rule logic.
Viewed
UK Water Utility
Take a KQL rule through review and testing
Give Sentinel detections a path from threat to testing
Return to the full story ←