Two inputs meet at the use case

Threat scenarios and business impact define the behaviour a detection needs to recognise. Source systems, identity and network context, parsers and data quality determine whether that behaviour is observable. My telemetry work included DNS source attribution and understanding cloud and on-premises traffic; the framework used these dependencies to connect a use case to the data it needs.