Pull request workflow

A pull request workflow is how a rule change is proposed, reviewed and approved before it ships. The author opens a pull request with the rule and its tests, a second engineer reviews, and a merge triggers deployment. It gives every change a reviewer and a record.

What Pull request workflow means here

Good review checks the logic, the test events, the ATT&CK tags and the expected volume. A short template keeps it consistent.

Some tools run checks on the pull request, but loading into the SIEM stays manual. Know where your tool draws that line.

Example of Pull request workflow in Splunk Enterprise Security documentation

Splunk's sample contentctl workflows build and unit-test content on pull_request, and loading it into a Splunk environment is left as a manual step. raw.githubusercontent.com read 2026-11-03

Terms related to Pull request workflow

• CI pipeline: A CI pipeline is the automated sequence that runs on each change to the rule repository: lint, validate, test and, on merge, deploy.
• Detection repository: A detection repository is the git repository that holds rules, tests and pipeline files.
• Rollback: Rollback is returning a rule to an earlier version after a change causes harm, such as a flood of alerts or a missed detection.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.