How data science can boost your detection engineering maintenance and keep you from herding sheep

This blog explains how to use data-science principles to maintain and improve detection engineering: defining goals, collecting and normalizing detection and post-deployment data (usecase.yml and env_usecase.yml examples), cleaning and analyzing time-series alert data, identifying broken or noisy detections, tuning/allowlisting strategies, deprecation criteria, prioritization techniques, and reporting considerations to make detection maintenance data-driven and scalable.