Good models start with good data. This lesson walks through the main sources of security telemetry — network logs, endpoint events, authentication records — and teaches you how to parse, clean, and engineer features from raw data. You’ll also tackle one of security’s trickiest ML challenges: severely imbalanced datasets.