Detection rule

A detection rule is a stored query or logic that runs over security data and raises an alert when it matches. It has a language, a schedule or trigger, a severity and usually ATT&CK tags. Products call them analytics rules, correlation searches, detections or rules, but the object is the same.

What Detection rule means here

A rule has three parts that matter for engineering: the logic, the metadata around it and the place it runs. The logic is written in the platform's language. The metadata includes severity, mapping and status. The place decides which data and fields the rule can see.

Because a rule depends on field names and sources, it can stop working when the data changes. That is the root of most rule health problems.

Example of Detection rule in Elastic Security documentation

In Elastic's detection-rules repository each rule is a TOML file in the rules directory, and the README says hand-writing the TOML is possible but not recommended. github.com read 2026-11-03

Terms related to Detection rule

• Detection repository: A detection repository is the git repository that holds rules, tests and pipeline files.
• Rule health: Rule health is whether a detection still runs, still sees its data and still earns its alerts.
• KQL: KQL, the Kusto Query Language, is the query language of Microsoft Sentinel analytics rules and hunting.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.