detect Framework

Limits

Framework v0.3.0, updated September 19, 2026.

The defaults are starting values. The 120-minute cap per true positive, the 90-day mandate window, the 180-day and 365-day retirement windows, and the 8 hours per rule are numbers to replace with a program's own once measured.

Precision, triage minutes, and the retirement triggers need alert outcomes exported from the SIEM. The repository does not yet collect them; the precision check is a scheduled job to be written.

The repository holds one complete detection. The scoring model has been exercised on eight sample candidates and the coverage chart on a 30-rule sample, both generated through the repository's own code, but neither is a production program.

The mapping to the Detection Engineering Maturity Matrix is listed as an open item and is not claimed.