A detection engineer in a SOC needs to build SIEM detection rules specifically targeting data exfiltration behaviour across DNS tunnelling, HTTP/S beaconing, cloud storage uploads, and email exfiltration channels. Generic SIEM content packs rarely address the specific data volumes, user baselines, and egress architectures of a particular organisation.