alisatodorova

detection-engineering

Detection rule development standards. Activate when: - Writing, creating, or modifying Sigma/YARA rules - Reviewing detection rules for quality or completeness - Discussing detection coverage, gaps, or improvements - Working with YAML files containing detection logic - Asked to validate, check, or audit detection rules - Converting detections between formats (Sigma to KQL, SPL, etc.)