A detection note explains what an alert is meant to find and how someone checked that it works. It helps responders maintain the rule and helps reviewers understand the evidence. A screenshot of a dashboard cannot replace the rule’s purpose, data needs, and test result.
Understand the idea
Write down the question, data source, important fields, trigger, likely innocent explanations, and response owner. Include a controlled example that should trigger the rule and one that should not. Record limitations, such as a missing source or a collection delay, instead of hiding them behind a successful test.
- Rule
State the behavior, data source, and detection version.
- Test
Record representative evidence and the expected result.
- Action
Show who received the alert and what they did.
A practical example
Imagine an alert for unexpected administrator creation. The note links the test account event to the resulting alert and the responder’s review. When the identity provider changes a field name, the team knows which part of the rule and test must be checked.
What to do next
- Explain the question. Describe the behavior the rule should find, why it matters, and the data needed to identify it.
- Name the review action. Give the responder an owner, likely innocent explanations, and a practical investigation route.
- Test both outcomes. Use controlled events that should trigger and should not trigger. Record the rule version, expected result, and actual result.
- Maintain the evidence. Record known gaps and repeat the test after relevant changes to the service or data source.
How to check the result
Keep the rule version, test date, expected result, actual result, and follow-up action. Repeat testing when the data source, rule, or protected service changes.
The alert was generated, but no one was assigned to respond.
Record that operational gap rather than presenting detection as complete. A useful control includes a review route and an accountable response.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
