opentide-detection-rule

Create MDR detection rules by defining a single YAML manifest with platform-specific configurations for Sentinel, Splunk, or Carbon Black Cloud. This approach drives multiple backend deployments from one structured file.

Yes, you can use a single YAML manifest to configure detections for Splunk and Defender for Endpoint. The manifest includes per-platform configuration blocks to enable multi-target deployments across these security operations platforms.

A valid MDR detection rule requires a specific schema version like mdr::2.1, a detection_model UUID, per-platform configuration blocks, plus description, metadata, and response sections. These elements ensure structured and deployable rule creation.

MDR detection rule standardization improves incident response by integrating rich response metadata and containment guidance directly into the rule. This streamlines analyst triage and reduces mean time to respond when detections trigger.

Yes, the MDR schema supports deployment to HarfangLab and Carbon Black Cloud. It provides per-platform configurations enabling a single manifest to drive multiple backends across these security operations platforms.

Ad-hoc detection rules lack consistent response guidance because they bypass standardized schema and DOM linkage. Using a structured MDR manifest unifies per-platform configurations and embeds response metadata to guide analysts during incidents.