// Investigation
Detection engineering
Correlation rules evaluated against the event stream. Disabling a rule stops it raising alerts but preserves the alerts it has already produced.
19rules19armed1ATT&CK tactics covered
Rule library
1 of 19 rules shown
| Armed | Rule | Severity | Category | ATT&CK | Alerts |
|---|---|---|---|---|---|
| Detection coverage reduced from the console A detection rule was disarmed or a suppression created. Both narrow what the platform reports, and an intruder who reaches the console will reach for exactly these controls before doing anything noisier. | High | Platform | T1562.001Defense Evasion | 0 |