// Detection

New rule

Write the logic, run it against stored telemetry, and see what it would have caught before arming it. A rule that fires four thousand times is not a detection, and production is the wrong place to find that out.

Identity

NameWhat it detects, and why it matters

SeverityCategoryATT&CK tacticTechnique

Logic

Matchable fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city. Operators: eq, neq, contains, not_contains, in.

Backtest

Runs the same evaluator the live sweep uses, against stored telemetry, writing nothing.

Window

Save

Backtest the rule before arming it. Saving disarmed is always available, so a draft is never blocked.