Security monitoring often starts as a spreadsheet of servers, firewall rules, and audit reminders. That works until the first real incident: a suspicious sudo session, a public SSH service receiving t...