Detection Engineering and Coverage Gaps Questions

Ability to design, implement, and assess detection logic and to identify telemetry or rule coverage gaps. Candidates should be able to translate attacker behaviors into concrete detection requirements, author and test rules across multiple telemetry types, tune detections to manage false positive rates, map coverage to adversary techniques such as those in the MITRE ATTACK framework, identify missing instrumentation or data sources, and recommend changes such as additional logging, endpoint controls, or network telemetry. The description should also cover testing practices, regression testing, metrics for coverage and detection quality, and processes for closing gaps.