Skip to content

Lab

Watch a rule fire. Or not fire, which is the interesting part.

Two tools. The first feeds an event to a detection and shows you every condition it checked, in order, with the value it actually saw. The second pushes the rule through the CI stages a detection should survive before anyone is allowed to be paged by it.

Nothing is sent anywhere. The page is static and every evaluation runs in your browser, using the same matching code our build tests run against these fixtures.

9 rules modelled 22 sample events Client-side only

Tool 01

Rule trigger checker

Pick a detection and an event. Every selection condition is evaluated in order, then the tuning filters get their say. A rule that matches everything and a rule that matches the right things look identical until you do this.

Sample event

Change a value and evaluate again. Flipping one field is usually enough to turn a detection into a miss, which is the whole argument for testing them.

Tool 02

Pipeline simulation

The same five gates described on the platform page, run against a real rule from this library. Four of them are genuine checks against the rule's own metadata and fixtures. The fifth is modelled, and says so.

Gates

  1. 01 Schema

    Structure parses, identifier is present and stable, log source declared.

  2. 02 House rules

    False positives documented, ATT&CK technique tagged, validation recorded.

  3. 03 Backends

    Every deployment target can compile this rule from its source language.

  4. 04 Tests

    True-positive fixtures must fire. False-positive fixtures must not.

  5. 05 Shadow

    Seven days enabled but silent, so the rule that would page 400 times cannot.

What this is and is not

Real

  • The match logic is modelled line by line from each rule body in the library.
  • The schema, house-rule and backend gates read the rule's actual metadata.
  • The test gate runs the published fixtures through the evaluator.

Modelled

  • This is not a Sigma engine. The library is Sigma, KQL, SPL and EQL; one parser would cover a quarter of it.
  • Shadow-deploy volume is a deterministic illustration, not a measurement from your estate.
  • Threshold and sequence rules cannot be judged from a single event, so they are not listed here.