Baselines as schemas, log-only mode as a dry run: a data engineer’s tour of SecOps vocabulary, the six-move baseline lifecycle and the Netlogon story.