Operationalizing a Hunt Into a Detection

When to Use

• A hunt surfaced malicious activity and you want to convert the discriminating logic into a repeatable detection (Sigma) with data sources, thresholds, and a tuning plan.
• You are closing the hunt→detect loop so the finding is caught automatically next time.

Do not use this to ship a rule without a false-positive review — operationalization includes tuning. The script generates rule scaffolding, not a deployment.

Prerequisites

• The hunt's discriminating fields/values, the data source/log channel, and the mapped ATT&CK technique.

Workflow

Step 1: Specify the detection

Define the logsource (category/product), the selection (field→value(s) that discriminated true positives), optional filters, the condition, and the ATT&CK technique.

Step 2: Generate the Sigma rule

python scripts/analyst.py generate --spec detection.json --out rule.yml

Emits a valid Sigma rule (title, status, logsource, detection, condition, level, tags) from the spec.

Step 3: Plan testing and tuning

Define how to validate (replay a known-true pcap/log, atomic test) and what benign sources may cause false positives.

Step 4: Document and stage

Record the rule's intent, expected FPs, and tuning levers; stage through your detection pipeline.

Validation

• The generated rule has logsource, detection, and condition keys.
• The selection encodes the fields/values that discriminated the hunt's true positives.
• The rule is tagged with the relevant ATT&CK technique.

Pitfalls

• Encoding incidental artifacts (one host's path) instead of generalizable logic.
• Omitting filters for known-benign sources, guaranteeing alert fatigue.
• No test plan, so regressions go unnoticed.

References

• See references/api-reference.md for the rule generator.
• Sigma specification and ATT&CK hunting resources (linked in frontmatter).