For years, security teams have built their security information and event management (SIEM) systems around rules. SIEMs identify patterns, look for specific log events, correlate sets of signals, and generate alerts when predefined conditions are met. Some platforms add machine learning and behavioral analytics on top of that. Even then, you’re still defining what normal looks like and where the thresholds sit. It’s rules either way. That model has served us well, but I believe it is about to change.