This document discusses threat detection strategies with "zero-cost" solutions. It outlines a threat detection architecture that centralizes logging, establishes context, and enables real-time and historical analysis. It proposes using free, open-source tools like Sysmon and Elastalert for data gathering and analytics to detect threats. The document concludes with a demonstration of detecting threats using ATT&CK tactics.