The SIEM detection rule has become the rule the SOC analyst has been writing, the rule the SIEM vendor has been shipping, the rule the breach disclosure will describe as the rule the enterprise should have had. The honest framing matters here, because the SIEM rule the enterprise has been paying the SIEM vendor for sits as the SIEM rule the SOC analyst has not been maintaining the way the rule needs to be maintained.
What follows runs as the working version of the field guide. The shorter version is what the SOC analyst and the SOC manager actually have time to read.
What the SIEM detection rule actually is
Here is the working order, by impact. The first runs as the query, where the query the analyst writes against the log source, the query that says what the SIEM should look for, the query that fires the alert the analyst will eventually triage, the query that sits as the heart of the rule. The second runs as the enrichment, where the enrichment the analyst adds to the alert, the enrichment that puts the user, the source, the destination, the time into the alert, the enrichment that tells the analyst whether the alert stands as the legitimate user doing the legitimate thing or the attacker using the stolen credential. The third runs as the response, where the response the rule triggers, the ticket the rule opens, the notification the rule sends, the response action the SOAR can take automatically, the response the analyst has been postponing because the response the rule triggers has been a manual triage ticket for years.
What the typical rule misses
Here is the working order, by impact. The first runs as the new attack pattern, where the pattern the analyst has been missing, the pattern the threat intel has been reporting, the pattern the SIEM vendor has not yet added the detection for, the pattern the analyst has to write the custom rule for, the pattern the analyst has been postponing because the analyst has been busy with the alert the rule has been firing. The second runs as the false positive, where the positive the rule has been producing, the alert the analyst has been dismissing as the noise, the noise that has been hiding the real attack the analyst would have caught, the noise the rule tuning should be reducing, the noise the SOC manager should be tracking as the quality metric the SOC manager has been postponing. The third runs as the context gap, where the gap the rule has been leaving, the gap where the alert does not tell the analyst what the user has been doing in the previous 30 days, the gap the analyst needs to make the triage decision, the gap the user behavior analytics the SOC has been deploying should be filling.
How to write the rule that catches the breach
Three moves if you are the SOC analyst or the SOC manager that wants the SIEM rule the enterprise has been paying for to actually catch the breach the rule is supposed to catch. Map the rule to the threat, where the threat the rule should map to (the MITRE ATT&CK technique, the known attacker pattern, the recent incident the SOC has been investigating), the threat that gives the rule the priority the rule needs, the threat that the analyst should reference in the rule documentation. Tune the threshold, where the threshold the analyst should set, the threshold that balances the false positive the analyst cannot afford against the false negative the analyst cannot ignore, the threshold the analyst should tune based on the baseline the analyst should measure, the threshold the analyst can tune in a sprint. Test the rule in staging, where the staging the analyst should use, the staging that has the known attack data, the staging the analyst should run the rule against before the rule ships to production, the staging the analyst can build in a week. The analyst or the manager that maps, tunes, and tests serves as the analyst or the manager that has written the rule that catches the breach.
The bottom line
SIEM detection rule in 2026 sits as the rule the SOC has been paying for that the SOC has not been maintaining. The query, the enrichment, the response, those three are what the rule is. The new attack pattern, the false positive, the context gap, those three are what the rule misses. The map to the threat, the tuned threshold, the staging test, those three are the moves. The analyst that does the three catches the breach. The analyst that has the rule on autopilot does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
