kibana log-analysis event-correlation incident-response servicenow cloudsecurity malware-detection mitre-attack qradar zscaler query-tuning detection-engineering defender-for-endpoint crowdstrike-falcon cortex-xdr phishing-analysis sop-development true-positive kql-microsoft-sentinel