A Synthetic Security Event Should Test the Whole Detection Path

A detection can pass a parser test and still fail in transport, indexing, alert delivery, or cleanup. A useful synthetic event proves the path from a controlled source action to searchable evidence and a bounded notification.