The lifecycle
Eight stages on three lines. The Backlog line carries intake, hypothesis, and research; the Build line carries build and validate; the Live line carries deploy, tune, and retire. Two loops close it: a tuning change is a pull request that returns to validate, and a retired rule's replacement enters intake with a link to the retirement note.
| Stage | What it is for | Exit gate, counted | Owner | Metrics |
|---|---|---|---|---|
| 1. Intake | Write down a request for a new detection with enough context that it can be scored. | 6 inputs, 6 evidence lines, 1 score | Detection engineering lead | intake_to_score_days, backlog_age_days |
| 2. Hypothesis | Write one sentence saying what the rule will catch, which log source it needs, and what it will miss. | 1 hypothesis, 1 data source, 1 blind spot | Detection engineer | readiness_at_hypothesis |
| 3. Research | Confirm the thing the rule looks for actually appears in your logs, then measure how often it appears during normal business. | 1 reproduction, 1 fixture capture, 7-day baseline | Detection engineer | research_hours_per_rule |
| 4. Build | Write the rule in Sigma and the tests that prove it. | 1 lint pass, N conversions, 2 fixtures | Detection engineer | percent_with_tests |
| 5. Validate | Prove the rule fires on the events it should catch, stays silent on the ones it should ignore, and that its converted query still matches the version a reviewer last approved. | N engine passes, N golden diffs, 1 approval | Second detection engineer (reviewer) | first_pass_validation_rate, review_turnaround_hours |
| 6. Deploy | Put the rule into production with alerting switched off, run it over the last 7 days of real data, and only then switch alerting on. | 1 seven-day replay, 1 threshold check, 1 enable | Detection engineering lead | deploy_lead_time_days, post_deploy_replay_failures |
| 7. Tune | Keep the share of true alerts above the agreed floor as the environment changes. | 1 precision check per 30 days, 0 changes outside the repo | Detection engineer with the SOC lead | precision_30d, triage_minutes_median, minutes_per_true_positive |
| 8. Retire | Remove rules whose alerts cost more analyst time than they are worth. | 1 status change, 1 disable, 1 record, 0 or 1 replacement | Detection engineering lead | rules_retired_per_quarter, rule_debt |
The full gate wording and the mistake that usually stalls each stage are in Appendix A.