A practical guide to building security monitoring that balances speed with context while optimizing costs and reducing false positives.