// tool reference · Monitoring & Detection

Detection Engineering Assistant Pro

脅威の説明やログのサンプルから、Sigma 検知ルール、SIEM クエリ、誤検知の調整方法、テストケースを作成します。

What it does

Turns a threat description in plain language into deployable detection logic — with the false-positive analysis that decides whether a rule survives contact with production.

When to use it

You know the behaviour you want to catch but not the rule syntax.
You need a Sigma rule plus honest FP notes before shipping it.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
intent	textarea	required	What you want to detect, in plain language.
source	select	任意	Log source the rule will run against.

What you get back

Detection logic, the reasoning, expected false positives, and test cases.

活用例

Input

Detect a user creating an inbox rule that forwards mail to an external domain

Output (abridged)

title: Suspicious External Forwarding Rule
status: experimental
logsource: { product: m365, service: exchange }
detection:
  sel:
    Operation: 'New-InboxRule'
    Parameters|contains: 'ForwardTo'
  filter:
    Parameters|contains: '@yourcompany.com'
  condition: sel and not filter
level: high

FALSE POSITIVES
  · execs legitimately forwarding to a personal address (allow-list them)
  · migration tooling during a tenant move

TEST: create a rule forwarding to an external address; confirm it fires.

How it works

AI generation constrained to a detection-rule format, reviewed against a defensive prompt. Output is text you review — nothing is deployed for you.

Limits

Read live from the platform configuration.

Rate limit

5 requests / 10 minutes

Limitations — what it does なし do

It generates a rule; it does not tune one. Output is untested against your baseline, so expect to iterate. A rule that has not met your real data is a hypothesis.

プライバシー

Your description is sent to the AI provider.

Standards

SigmaMITRE ATT&CK