All playbooks
Detection engineering · Detection engineers and SOC reviewers
Detection rule peer review
Review behavior, telemetry, logic, evidence and analyst handoff.
A useful review leaves another analyst able to explain what the rule observes and what remains untested.
What this does not establish
- A valid Sigma document does not prove the target query is correct.
- An ATT&CK tag does not prove deployed coverage.
- One positive match does not characterize benign activity.
0 of 8 ticked
Selected step
FrameStep 1 of 8
Agree on the behavior before editing syntax.
Write the behavior in one sentence
- Name the subject, action and observable outcome.
- Separate the hypothesis from what any one event can establish.