The overview explains the three rule shapes. Then write rules, import Sigma, KQL and EQL, enable the content pack, control noise with exceptions and suppressions, check ATT&CK coverage and put baseline signals to work.
Detections
Rules: how they run, how to write and import them, the content pack, noise control and coverage.