Cybersecurity definition
What is Detection Rule?
By Cyber Tool Stack Editorial TeamUpdated
Definition
Logic that turns raw log or telemetry events into a security alert when a specific suspicious pattern is matched.
Where Detection Rule fits in the security landscape
These beginner lessons use this term while explaining the surrounding security control.
Related cybersecurity terms
SIEMSecurity Information and Event ManagementA central system that collects logs from across an environment, correlates them into alerts using detection rules and behavioral baselining, and lets analysts search historical activity during an investigation.LogA timestamped record of an event generated by a system, application, or device, used for troubleshooting and security investigation.