Covers detection engineering: writing and managing detection rules as code with Sigma and version control, and running the detection lifecycle from hypothesis through build, test, deploy, tune and retire. Explains MITRE ATT&CK coverage mapping, true and false positives, alert fidelity and testing detections with Atomic Red Team.