Detection engineering

Detections are software. They need a hypothesis, a data source, testing, version control and somebody who owns them.

Treated as configuration, they rot: the log format changes, the field is renamed, the rule silently matches nothing and nobody notices because an absence of alerts looks like good news. Treated as code, they get tested and reviewed like code. The difference shows up as whether your detections still work a year after they were written.