Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
The written logic that decides when to raise an alert, such as "flag any command shell launched by a Word document". Rules live in the SIEM or the EDR and run against data as it arrives.