Design a security monitoring framework

Design a framework that collects security signals such as logs and events from many systems, detects suspicious activity, raises alerts and supports investigations. Cover ingestion, how detection rules run, storage, and how teams add new detections.