JELAJAH SOC
YO

Engineering

Rule lifecycle & coverage

A detection is a product with a lifecycle, not a file you commit once. Track each rule from idea through backtesting, tuning and eventual retirement — and read coverage as a question about depth, never as a scoreboard.

Rules in production

2

Average precision

0.90

Needing tuning

1

Technique coverage

45%

breadth only — depth varies

Idea

1

Draft

1

Testing

1

Tuning

1

Production

2

Retired

1

Fixed-interval outbound resolution

R-503 · T1071.004 · owned by Hunt team

Tuningchanged 2 days ago

Precision

0.42

Volume · 30 days

188

False positives

109

Software-update pollers dominate. Needs an allowlist plus a jitter threshold.

Suggested next action

Precision below 0.5 means the queue pays for this rule. Add a scoped exclusion, tighten the condition, or move it to a hunt query rather than an alert.

Open rule builderBacktest in explorerConvert to hunt

Coverage by tactic

Breadth of technique coverage — not a measure of detection quality.

  • Initial Access5/9
  • Execution9/12
  • Persistence8/19
  • Privilege Escalation7/13
  • Defense Evasion14/42
  • Credential Access11/17
  • Discovery9/31
  • Lateral Movement6/9
  • Collection5/17
  • Command and Control10/16
  • Exfiltration4/9
  • Impact6/13

One rule against a technique marks it “covered” even if it only catches the laziest variant. Treat this chart as a map of where to ask harder questions, and never present it to leadership without that caveat.

Tuning without going blindmethod›
  • Exclude the narrowest thing that works: one service account on one host beats excluding a whole process name estate-wide.
  • Every exclusion gets a comment with the reason and the date. Unexplained exclusions become permanent blind spots.
  • Prefer raising the bar (thresholds, sequences, rarity) over deleting conditions.
  • Re-measure precision after two weeks; tuning that was never verified is just hope.
When a detection should be a hunt instead›

If the logic cannot reach usable precision but the behaviour still matters, it does not belong in the alert queue. Move it to a scheduled hunt query reviewed weekly. You keep the visibility and stop paying analyst attention for it every day.

Learn this capability

Hands-on labs that build the technique behind this workspace. Skills transfer to any mainstream SIEM.

Intermediate · Theory · 16 min

Detection quality principles

You own the detection catalogue. Every rule you deploy costs analyst attention, so quality is measured in outcomes, not count.

Intermediate · Simulation · 40 min

Testing against historical data

Before deployment every rule must be backtested. A rule that has never run against real data is an untested assumption.

Intermediate · Guided Lab · 26 min

Tuning noisy detections

DET-0119 is producing more false positives than true ones. Analysts have started ignoring it — the worst outcome for any detection.