Detection rule library
Rules from the posts, ready to copy
Every rule links back to the write-up that explains it. Tune thresholds and exclusions to your environment before you deploy.
No rules published yet. They arrive with the posts that explain them.
Rules are shared as-is. Test in a staging manager before production. Need help tuning? Ask about a detection review.