TID Operator: Detection & Monitoring Operations

Splunk, ELK, or Microsoft Sentinel: configuration, queries, and dashboards.

Reading and interpreting security logs from multiple sources.

Systematic alert triage: prioritization, escalation, and documentation.

Identifying indicators of compromise in logs, traffic, and system artifacts.

First-responder procedures for common incident types.

Monitor a live environment, triage alerts, and escalate a real incident.