Most of the time when a team says “our detection rules aren’t working,” it’s not the logic that’s broken —…