Covers security data engineering: collecting, parsing, normalising and enriching security telemetry, onboarding log sources, and building SIEM pipelines and security data lakes with schemas such as OCSF. Explains retention, storage tiering and cost control for security logs and how to keep detection data complete, timely and correct.