Does your cup overflow with indicators? Sensors run hot? Analysts tired from alert fatigue? This talk is for those interested in a pragmatic model for building an indicator consumption pipeline that results in actionable, prioritized, relevant detections for your event analysts & responders. Using proven techniques from several of the world's largest environments, Ryan Stillions will discuss key steps to optimizing indicator consumption and reclaiming your alert consoles.