CYBERESCUDO / DETECTION ENGINEERING
Does your rule detect
what you think it does?
Go from writing a detection to testing it. Examine the hits, investigate the noise and compare a second version.
- Synthetic data
- No server upload
- No account or official score
02 Define the signal
What this engine tests and what it does not
Case-insensitive text conditions: equals, contains, startswith and endswith, combined with AND or OR. No arbitrary YAML, wildcards, regular expressions or time correlation. Unsupported input is rejected: it does not mean zero detections.
Events from another source are out of scope. A missing field does not satisfy a condition. Unlabeled events can match, but do not count as correct or incorrect.
03 Read the evidence
A rule is a hypothesis.
Run the test. Then pin version A, change the rule and see what you gain and what you lose.
These metrics describe this synthetic dataset. They do not estimate your real coverage or guarantee production detection.
04 Inspect each event
Open an event to see its fields, conditions and labeling context.