From audit log to detection

From audit log to detectionlogs nobody reads are just storage cost

An audit log earns its keep when it drives an alert. Detection engineering, in its basic form, is turning the events you log into signals on access that doesn't fit the normal pattern. You don't need a SIEM cathedral to start; you need a few high-signal rules.

• Break-glass used - page immediately, every time, no exceptions.
• A JIT grant for an unusually broad scope or a grant that touches a resource the requester has never touched before.
• A burst of decrypt calls or access from a new geography or a new ASN for a given identity.
• An agent sandbox attempting egress to a blocked destination like the metadata endpoint - that's an escape attempt, treat it as one.