Security

Most "too many alerts" complaints are actually "we wrote rules against events instead of behavior" complaints. Tuning one Sigma rule across three passes, from a string match anyone could evade to a correlation that actually costs an attacker something.

Notes from reading all 121 pages of the Verizon 2026 Data Breach Investigations Report, a few months into a SOC internship — vulnerability exploitation overtaking credential abuse, AI scaling known ATT&CK techniques rather than inventing new ones, and what that actually changes about the detection rules you write.