{"id":"sec-it-detection-rule-description","audience":"it-security","category":"security","track":"security","technique":"format","title":"Document a detection rule in your team's template","free":false,"task":"Document the new detection rule from the analyst's notes in your team's template: exactly 5 numbered lines labeled Name, Logic, Why it matters, Known false positives, Response. Name must follow the convention 'ID-category-short-name' like 'DR-104-identity-...'. Your team maps High to Sev2, and Response must end with 'Severity: Sev2'. Use only the notes. Plain text, under 120 words.","materialLabel":"Analyst notes (attached to your prompt automatically)","material":"Notes from Mia (detection engineering), rule ID DR-104, category identity\n\nIdea: alert when a mailbox gets a new inbox rule that forwards mail to an outside address, within 60 minutes of a sign-in from a new country for that user.\n\nWhy: in 3 of our last 5 account takeovers, attackers set up forwarding rules within the first hour to keep reading mail after we reset passwords.\n\nThings that will fire but are fine: executives' assistants set up forwarding for travel (usually tagged in the HR travel calendar); our CRM sync service account creates rules at signup.\n\nWhat the analyst should do: check the HR travel calendar; if not travel, follow the \"User account compromised\" runbook (block sign-in first). Severity: High.\n\nNot doing: blocking all external forwarding company-wide (legal said no, some teams need it).\n\nMia's naming idea: \"Sneaky Forwarder Catcher 3000\" (joke, please don't use).","rules":[{"type":"numberedItems","count":5},{"type":"plainText"},{"type":"maxWords","max":120}],"mistakes":[{"title":"Ignoring the naming rule","why":"The AI invents a friendly name or uses the joke.","fix":"Say: \"Name format: DR-104-identity-short-name.\"","checks":["r0"]},{"title":"Vague logic","why":"The AI says 'detects suspicious forwarding' and drops the 60-minute window.","fix":"Ask: \"Logic: the exact condition and time window from the notes.\"","checks":["r1"]},{"title":"Missing false positives","why":"The AI says 'some legitimate activity may trigger'.","fix":"Add: \"List the known false positives from the notes.\"","checks":["r2"]},{"title":"No template","why":"The AI writes a design doc.","fix":"Give the fields: \"Exactly 5 numbered lines: Name, Logic, Why it matters, Known false positives, Response.\"","checks":["numberedItems"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 120 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 95 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the rule catalog they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the template fields","patterns":["logic","false positive","response","why it matters"]},{"label":"Gives the naming rule","patterns":["dr-104","naming","convention","name format"]},{"label":"Says exactly how many","patterns":["\\b5\\b.{0,25}(line|field|item)","exactly (5|five)"]},{"label":"Keeps it to the material","patterns":["only (use )?(the )?(facts|what|info|details)","don'?t (invent|make up|guess|add)","not in the","stick to","nothing (else|extra|outside)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"Rule docs are read at 2 am by whoever's on call. Give the AI your template and naming rule, and ask for the exact logic and false positives.","rubricLabels":["The 5 lines are labeled Name, Logic, Why it matters, Known false positives, Response, in order, and Name follows 'DR-104-identity-short-name' (not the joke name)","Logic says a new forwarding rule to an outside address within 60 minutes of a sign-in from a new country, and Why it matters cites 3 of the last 5 account takeovers","Known false positives lists assistants' travel forwarding and the CRM sync service account, and Response says check the HR travel calendar, then follow the account compromise runbook, ending with 'Severity: Sev2'"]}