Start with what you are protecting
Monitoring everything equally is the fastest route to monitoring nothing effectively. Identify the systems and data whose compromise would genuinely disrupt the business.
That list is usually shorter than expected, and it dictates everything downstream.
Work backwards from plausible attacks
For each critical asset, describe how it would realistically be reached: through which identities, which hosts, which network paths, which applications.
Each step in those routes is a detection opportunity. This is what turns monitoring from a data-collection exercise into a defensive design.
Map telemetry to those opportunities
Only now does the question of log sources arise — and it arrives with a clear test: does this source let us observe a step in a route that matters?
Sources that fail that test are storage cost, not security value.
Decide what happens when something fires
A detection with no defined response is a notification, not a control. Establish who acts, what authority they hold and what the escalation path is before go-live.
This is also where coverage hours get decided honestly: an alert nobody sees until Monday has a different value to one seen in ten minutes.
Validate, then iterate
Test the detections. Run the scenario. Establish empirically whether the activity is observed and whether the response works.
Strategy that has never been validated is a document. Strategy that has been tested is a capability.