The documented Use Case Pipeline covers justification, source-log prerequisites, KQL implementation, logic review, release and tuning, followed by a test trigger and deeper analysis. I introduced priorities, stages and ownership for new detections and tuning requests, and supported a repository containing versioned Sentinel rule logic.
Viewed
UK Water Utility
A delivered lifecycle for detection work
From business risk to detection
Return to the full story ←