Writing, Tuning and Correlating Detection Rules

Turn a behaviour into a detection rule, see why the first version drowns analysts in noise, tune it without going blind, combine two signals into one strong alert, and map it to MITRE ATT&CK.