The detection-as-code pattern, MITRE ATT&CK mapping, false-positive triage, and the small set of habits that turn detection from a backlog into a discipline.