What is a detection rule?¶

A detection rule is a defined set of conditions used by a security platform to identify activity considered suspicious, important or worthy of review.

When the conditions are met, the system may create an alert.

Avoid the dangerous assumption¶

The dangerous assumption is that a detection rule is an objective statement that the activity is malicious.

It is not.

A rule may look for a known event code, a sequence of actions, a source address, a file hash, repeated failures or a particular command. It may also combine several fields and apply exceptions.

Detection rules are designed by vendors, administrators or security teams. They reflect available knowledge, local risk, technical capability and operational priorities.

A rule may be broad to avoid missing threats, which can create false positives. It may be narrow to reduce alert volume, which can miss relevant activity. Its result also depends on whether the necessary source records were collected and parsed correctly.

Investigators should obtain the rule name, description, logic, data sources, thresholds, exceptions and version. Ask when it was enabled and whether it changed after the event.

A plain-language rule title may simplify the actual conditions. A rule called “account takeover” may only detect a new location followed by a password change.

Preserve the underlying source events and any enrichment used by the rule. Test whether the conditions were genuinely met and whether an ordinary explanation exists.

Operational takeaway¶

A detection rule is a configured method for identifying activity of interest, not a factual finding of maliciousness, and its evidential value depends on its logic, data, version and limitations.