Definition. The task of filtering, correlating and prioritising security-relevant events from logs, metrics, traces and runtime sensors, whether rule-based, statistical or model-based. The result is manageable alerts with context, not raw logs.

Why it matters. At mid-sized companies, the quality of detection often matters more than the number of tools. A few precise alerts with clear playbooks are manageable. A stream of unsorted events is not.

Related. Runtime Security, Falco, Tetragon, DevSecOps