Detection & Response
Detection Rule
Also: detection, signature, policy rule
A defined pattern that flags a risky action, such as reading an SSH key or running a recursive delete.
In more detail
Rules should be specific enough to avoid noise and cheap enough to evaluate on every action. Track how often each fires and how often it was right, and retire or tune the ones that are not earning their keep.