Writing detections that support an investigation

Detection quality is measured by the decisions it enables during a live response.

More detail coming soon.