# Detection Engineering: Building a Rule That Survives Contact (lab)

> A production rule fired on one workstation. The host was triaged, the file removed, the alert closed. A later review of egress records found the same external destination contacted from several other…

Canonical: https://codelivly.com/labs/detection-engineering

| | |
|---|---|
| Type | Investigation |
| Difficulty | Advanced |
| Points | 500 |
| Session length | 1 h |
| Completions | 2 |

A production rule fired on one workstation. The host was triaged, the file removed, the alert closed. A later review of egress records found the same external destination contacted from several other machines, none of which ever alerted. The triage was correct; the rule was not. You are rebuilding it, and the review board wants measurements rather than assurances.

## Objective

Work out why a rule that describes the right technique still missed most of the activity it was written for, rebuild it on a property the operator could not change, and then measure the rebuilt rule over four days of real telemetry — because the rule that finds everything and the rule that can actually ship are usually not the same rule.

## Tasks

1. Read the rule that missed, and name the assumption in it
2. Find the property that did not move
3. Measure the naive rule honestly
4. Identify the legitimate activity you cannot simply exclude
5. Key the exclusion on something the operator does not own
6. Classify it

## Related

- [All labs](https://codelivly.com/practice?type=lab)