Lab 13: The Attack Ran. The Alerts Didn't Fire.

In Lab 12, I built the detection rules. Three prebuilt Elastic rules targeting Linux attack techniques. One custom KQL rule for SSH authentication failures. The pipeline was configured, the rules were