Define the evidence
For each use case, state which fields and event types are required, what normal volume looks like, how quickly the data must arrive and how long it must remain searchable.
This keeps the detection tied to observable evidence instead of an assumed log source.
Design for silent failure
Collection failures are often quiet. Monitor freshness, field completeness, parsing drift and source coverage separately from alert volume. A healthy detector with an empty input is not healthy.
Give the contract an owner
Document who can repair the source, who validates the parser and who decides when a breaking schema change is acceptable. Ownership turns telemetry quality from a periodic cleanup into an operating practice.