Should we build detection on this new data source?

Measurement & estimationHard

Problem. Salesforce acquired a company, and their platform produces a large stream of telemetry that nobody in the SOC has used before. Your manager asks whether we should build detection on it. How would you answer?

Before you reveal: say your answer out loud, as if you were in the real interview — get your reasoning across clearly first. There is no single correct answer: reading what the interviewer is really after and defending your own thinking is what makes an answer strong.

Define success for a new insider-threat detector →