The reference pipeline
The repository is a template: fork it, replace the example, point the secrets at a Splunk Cloud stack. Each detection is a directory holding rule.yml (Sigma), ads.md (the ten sections of the Alerting and Detection Strategy format), score.yml (six inputs, six evidence lines, CI-written score), test fixtures, and the approved copies of the converted queries.
| Stage | Sigma status | CI jobs | Artifact |
|---|---|---|---|
| 1. Intake | no rule file yet | score | score.yml with stage set to intake |
| 2. Hypothesis | no rule file yet | none | The Goal, Categorization, Strategy Abstract, and Blind Spots and Assumptions sections of ads.md |
| 3. Research | no rule file yet | none | The Technical Context section of ads.md; tests/events.jsonl |
| 4. Build | experimental | lint, convert | rule.yml, tests/events.jsonl, tests/expected.yml |
| 5. Validate | test | lint, convert, replay (one leg per engine), golden-diff, review | Passing CI run; approved pull request |
| 6. Deploy | stable | deploy, post-deploy-replay, enable | A deploy record: version, date, SIEM, and the alert count from the 7-day run |
| 7. Tune | stable | precision-check (scheduled) | A tuning pull request that cites the alert ids that prompted it |
| 8. Retire | deprecated | disable | A retirement note in ads.md: reason, date, and the id of the replacement rule |
Six tools, one per gate. Lint checks the layout, parses the rule, confirms the id and tag agree, confirms the Sigma status matches the stage, checks the ten ADS sections, confirms every named fixture exists, validates the score record, and rejects any ATT&CK technique id that is not in the pinned map. Convert produces SPL and KQL and fails when either differs from the approved copy. Score computes and sorts. Metrics fills what only the file layout can tell. Package builds a Splunk app with alert actions off, then on. Replay runs the fixtures through a Splunk container and the Kusto emulator, and runs the 7-day production check against the threshold.
What has been executed on the example: lint, convert with the golden check (a tampered copy failed as intended), a wrong Sigma status failing lint, a bogus technique id failing lint, score, metrics, packaging with alert actions off and on, and dry runs of both replay engines. What has not been executed anywhere yet: the live Splunk and Kusto calls, the two container services in the workflow, and the AppInspect and ACS steps, which are placeholders.