Telemetry
Check whether relevant events are collected, retained, and available to investigators.
Blue teaming
Review the visibility your team depends on. Identify gaps in logging, detection coverage, and investigation procedures.
Detection coverage
Review rules against expected threats and identify gaps or sources of unnecessary noise.
Investigation
Review triage steps, escalation paths, and the context available when an alert arrives.