Finding malicious activity in systems, networks and cloud environments as early as possible. Covers detection rules and analytics over logs and telemetry, behavioural and ML-based detection, SIEM and XDR alerts, threat hunting, and triage for response.