This talk explores how abstracting detection intent allows scaling detection to large organizations and data volumes. We show what it looks like to abstract detection intent, and how the separation of concerns allows better efficiency across a large organization.