Detection Engineering.
commit to the idea of unit testing detections, you commit to that being continuous. Another dimension here: reality or simulation? Do you trigger the activity (very obviously impossible or insanely risky in some cases) or do you inject the logs into your SIEM? The answer is of course “yes.” Don’t