XDR Detection Engineering: Crafting Rules at Scale

Sekoia describes its XDR detection-rule lifecycle: standardizing fields on ECS and migrating from STIX to Sigma, enforcing rule syntax via a YAML linter and GitHub actions, validating logic with test JSON samples and staging (silent) rules to detect false positives, and mandating ADS documentation for each rule; upcoming plans include enforced staging periods, automated mapping checks, and opening contributions via a public GitHub repository.