Detections

Detections are the rules that turn raw events into alerts. SecureOPS ships with curated rule packs mapped to the MITRE ATT&CK framework, and lets you write custom rules for anything specific to your environment.

Rule packs

Rule packs are maintained collections of detection rules grouped by source and threat category. Enable them under Detections → Rule packs.

Rules receive updates automatically as new techniques emerge — no action needed on your side.

Alert severity

Every rule has a base severity (informational → critical). The final severity of an alert can differ from the base: the AI SOC analyst adjusts it using asset criticality, threat intelligence matches, and correlated activity from the same entity.

Tuning

False positives are handled with suppressions, not by disabling rules:

1. Open the alert and choose Suppress.
2. Scope the suppression — by host, user, process path, or any field combination.
3. Set an expiry. Permanent suppressions are supported but reviewed quarterly.

This keeps the rule active for the rest of your environment while silencing the known-good case.

Custom rules

Write custom rules under Detections → Custom rules using the query language:

source:windows-security event_id:4688
| where process_path contains "\\Temp\\"
| where parent_process != "explorer.exe"

Each custom rule needs a name, severity, ATT&CK technique mapping, and a run schedule (streaming or interval). Test against historical data with Preview before enabling.