I Built a Home SOC Lab, Then Spent a Week Finding Out My Own Rules Were Silently Failing

How chasing “100% detection coverage” in a Wazuh + Sysmon lab turned into a masterclass in why detection engineering is mostly debugging.