Existing Rule Filename
detection-rule-5.yml
Rule Name
Detection Rule 5
Rule Status (Optional)
None
Rule Description (Optional)
No response
References (Optional)
https://test.one.com
https://hello.one.org
https://acme.tv
Modified By
FB Mod User 1
Modified Date
2025-12-01
MITRE ATT&CK Mapping (Optional)
attack.T1234
attack.T6789
Vendor Data Sources (Optional)
ACME
Service Data Sources (Optional)
HappySpace
Detection Query Before
Query 123
Detection Query After
Query 456
Detection Query Condition (Optional)
No response
Detection Query Suppress (Optional)
No response
Severity (Optional)
None
Outcome (Optional)
No response
Review Last Reviewed
2025-12-01
Review Next Review
2026-12-01
Expiry Date (Optional)
No response
Summary of Changes
Update query to reduce the number of false positives.
Update Vendor name.
Update Service name.
Existing Rule Filename
detection-rule-5.yml
Rule Name
Detection Rule 5
Rule Status (Optional)
None
Rule Description (Optional)
No response
References (Optional)
Modified By
FB Mod User 1
Modified Date
2025-12-01
MITRE ATT&CK Mapping (Optional)
Vendor Data Sources (Optional)
ACME
Service Data Sources (Optional)
HappySpace
Detection Query Before
Query 123
Detection Query After
Query 456
Detection Query Condition (Optional)
No response
Detection Query Suppress (Optional)
No response
Severity (Optional)
None
Outcome (Optional)
No response
Review Last Reviewed
2025-12-01
Review Next Review
2026-12-01
Expiry Date (Optional)
No response
Summary of Changes
Update query to reduce the number of false positives.
Update Vendor name.
Update Service name.