Measure before changing
Review which rules are enabled, which data sources they need, the alerts they produce and analyst feedback. A rule that produces no alerts may be working correctly, missing data, too narrow or no longer useful. Check the supporting measures before changing it.
Govern the change lifecycle
-
01
Identify the need
Use evidence, coverage, threat context, and verified outcomes to define the gap or quality problem.
-
02
Design
State the intended behavior, trusted sources, conditions, exclusions, suppression, and alert evidence.
-
03
Validate
Check structure, data availability, expected matches, false-positive risk, novelty, and operational effect.
-
04
Approve and publish
Use the configured review path and preserve version, owner, rationale, and validation result.
-
05
Observe and improve
Review activity, coverage, feedback, drift, and rollback needs after publication.
Treat AI-assisted proposals as proposals
Where available, Nova can identify gaps in detection coverage and draft proposed rules. Review the proposed conditions, the reason for the change, required sources and validation results. Creating a draft does not activate or publish the rule.