When Detection Engineering Becomes a Data Engineering Problem

In a security data lake, a detection can be correct and still never finish. How two months of PySpark tuning became 34 rules that cut runtime up to 60%.