Detection as code
Writing detections like software: Sigma rules, unit tests with attack telemetry, false-positive budgets, coverage against ATT&CK, and shipping through CI.
🔒 PROLesson·24 min read·Intermediate → Advanced
detectionSigmaATT&CKCI
01A detection has a lifecycle
✓What you will learn
- Write a Sigma rule with the right level of specificity
- Test detections against replayed attack telemetry
- Track coverage and precision instead of rule counts
title: Suspicious kubectl exec into production pod
id: 7c1a2d3e-...
status: experimental
logsource: { product: kubernetes, service: audit }
detection:
selection:
verb: create
objectRef.subresource: exec
objectRef.namespace|startswith: prod-
filter_breakglass:
user.username|endswith: '@breakglass.cyart.io'
condition: selection and not filter_breakglass
falsepositives: [Approved incident response with break-glass identity]
level: high
tags: [attack.execution, attack.t1609]- Hypothesis: which ATT&CK technique, which log source proves it.
- Rule: written in Sigma or the SIEM's language, in git, reviewed like code.
- Tests: a positive sample from a real or simulated attack, negative samples from a week of production noise.
- Deploy: CI compiles to the target backend, deploys to staging SIEM, then prod.
- Measure: precision (alerts that were real), time to triage, and whether it ever fired at all.
- Retire rules that never fire or never prove true.
“How to say it in the room
"I treat a detection as a unit-tested function from telemetry to alert. If I cannot produce a log sample that trips it, it does not ship. If it fires twenty times a week and never proves true, it gets fixed or retired."
This is an advanced module
Detection & Response Engineering is part of the Pro pass. 0 more sections — the deep dives, the final design, follow-ups and the test — unlock with it.
Already a cyart.io or studio.cyart.io member? Your pass code is in your Studio account.