Rule versioning

Rule versioning keeps every revision of a rule so you can see what changed, who changed it and when. In a git-first workflow the repository is the history. Some products also keep revisions in the platform, so console edits are tracked too.

What Rule versioning means here

Platform-side history matters when someone edits a rule in the console, outside the repository. Without it, the repo and the SIEM drift apart.

Look for a diff view, an author and a way to restore.

Example of Rule versioning in Google Security Operations documentation

Google's docs describe View rule versions and Archive rules alongside the live and alerting states of a rule. docs.cloud.google.com read 2026-11-03

Terms related to Rule versioning

• Rollback: Rollback is returning a rule to an earlier version after a change causes harm, such as a flood of alerts or a missed detection.
• Rule lifecycle: Rule lifecycle is the set of states a rule moves through, from draft and test to production, scheduled for deprecation and retired.
• Detection repository: A detection repository is the git repository that holds rules, tests and pipeline files.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.