1.2.1. From Raw Telemetry to Alerts
💡 First Principle: A detection is a standing question asked of telemetry: has anything matching this suspicious pattern happened? The quality of every alert depends on two things you control: whether the right data is collected at all, and whether the detection logic is specific enough to separate attack behavior from normal business.
Telemetry is the factual record produced by sensors: an endpoint sensor records process launches, file writes, and network connections; an identity provider records sign-ins; a mail gateway records message delivery; a firewall records sessions. None of this is an alert yet. It becomes one only when detection logic fires. That logic comes in several forms you'll configure later: built-in detections shipped by Microsoft (Defender products raise these automatically), rules you author (Defender XDR custom detections and Sentinel analytics rules, Phase 2), threat intelligence matching (an observed IP or file hash appears on an indicator list), and machine learning that flags deviations from a learned baseline.
Every alert carries a few properties that drive triage. Severity (Informational, Low, Medium, High) estimates potential impact. Detection source tells you which product or rule raised it, which tells you where to pivot for detail. Category or MITRE ATT&CK tactic tells you where in an attack the behavior sits. And entities (users, devices, IPs, files, mailboxes, URLs) tell you what the alert is about.
The upstream dependency is the one exams love: a detection cannot see data you never ingested. If Windows Security events from domain controllers aren't collected, no rule can alert on a suspicious Kerberos pattern there, no matter how good the logic is. That's why ingestion (2.2) sits before detection (2.5) in this guide.
⚠️ Exam Trap: When a scenario says "the analytics rule never fires even though the attack occurred," check the data path before the rule logic. Missing connector, missing data collection rule, or wrong table is a more common root cause than a broken query.
Reflection Question: Why does adding more detection rules not help, and sometimes hurt, if the telemetry those rules need isn't being collected?
