Detection Rule
Noun · Security & Infosec
Definitions
A concrete rule in a SIEM, EDR, IDS, or similar tool that triggers an alert when defined conditions are met. Detection rules can be signature-based, threshold-based, or behavioral depending on the data source and use case.
In plain English: A rule that tells a security tool when to raise an alert.
Example: "The new detection rule alerts only when the suspicious command line appears on servers that should never run script interpreters."