Several mechanisms, one object
Behavior-native rules, correlation, statistical methods and threat intelligence can evaluate the same structured activity.
[architecture]Platform / Detection
Detection reads behavior instead of rebuilding it.
Rules, analytics and correlation mechanisms evaluate a shared behavioral object while remaining independent of the representation layer. [architecture]
A firing remains inspectable
A detection can retain which behaviors supported it, while each behavior retains the evidence from which it was constructed.
[architecture]Tuning starts from structure
Detection engineers can inspect context, actions, effects and coverage gaps rather than inferring them from an alert summary.
[architecture]