Understand the Nova Autonomous Detection Engine

The Nova Autonomous Detection Engine reviews evidence already available in Nova for gaps in detection coverage. It can draft a proposed rule, explain why it may help, identify the activity it should detect and link relevant attack techniques.

NADE can discover opportunities and prepare drafts automatically. A draft is not an active rule. Activation still requires the relevant checks and approval, and proposals that lack evidence or fail validation do not proceed.

Coverage gaps

Recurring activity or security questions that the current detection set does not fully address.

Reviewed anomaly context

Behavioral change from Qyronis used as context, never as proof on its own.

Threat relevance

Applicable threat intelligence and technique context that explains why a proposed detection matters.

Observed evidence

Evidence from the customer's environment that explains why the proposed rule is relevant.

Detection outcomes

Alert volumes, analyst feedback and changes in rule behavior that may show where detection needs improvement.

1. 01
   Qualify

   Confirm the coverage question and the evidence that supports it.

2. 02
   Draft

   Draft a rule with the reason for the change, expected alerts and relevant attack techniques.

3. 03
   Validate

   Check structure, novelty, required fields, evidence support, and intended behavior.

4. 04
   Review

   Let the responsible customer team examine the proposal, limitations, and validation result.

5. 05
   Govern

   Keep publication or activation behind the configured approval and change path.

• The coverage need and the customer evidence that supports it.
• The proposed detection logic and the source family it is designed to evaluate.
• The expected signal, technique context, and reason the proposal may improve coverage.
• The novelty, structure, quality, and evidence checks performed before review.
• The current lifecycle state, review history, and any reason the proposal cannot advance.

• The engine does not assign Qyronis anomaly scores or replace NovaSignal alert prioritization.
• A proposal remains inactive by default and cannot become a live rule through drafting alone.
• Missing evidence, invalid structure, or failed validation blocks advancement.
• Customer review and the configured governance path determine whether a validated proposal is accepted.