Purple › Module 4 › Lesson 3
Rule Lifecycle
Rule lifecycle literacy names draft, test, review, deploy, tune, retire stages — document lifecycle on YOUR $PURPLE_LAB before production rule changes.
Visual · t35_rule_lifecycle
Rule lifecycle literacy. $PURPLE_LAB only. Original Cyberlium.
Opening
Rules age like milk — literacy teaches lifecycle stages so detection stays accurate through purple exercise feedback.
Rule lifecycle flows draft → test → peer review → deploy → monitor → tune → retire. Draft: author Sigma in Git branch. Test: replay logs on lab hosts, measure TP/FP. Review: PR with detection engineer sign-off. Deploy: pipeline to lab then production SIEM. Tune: purple exercise findings trigger updates. Retire: deprecate when telemetry or threat landscape changes. Cyberlium writes lifecycle row on YOUR $PURPLE_LAB — map six stages for one fictional rule with owner and artifact per stage. Next: Sigma Lab.
1. Lifecycle stages (named)
Draft: Sigma YAML in feature branch with ATT&CK tags. Test: log replay against lab simulation telemetry, FP baseline check. Review: PR approval, lint pass, peer comment. Deploy: tagged release to lab SIEM, then production after purple sign-off. Tune: update from exercise gaps. Retire: status deprecated, removal ticket.
On $PURPLE_LAB, write lifecycle row — stage, artifact, owner for one fictional T1059 rule.
Command guide
Try these commands — Lifecycle stages (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Sigma lifecycle — https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide Elastic rule workflow — https://www.elastic.co/guide/en/security/current/rules-ui.html NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export PURPLE_LAB=${PURPLE_LAB:-$HOME/cyberlium-lab/t35-purple}
cat > "$PURPLE_LAB/notes/rule-lifecycle.md" <<'EOF'
# Detection Rule Lifecycle — YOUR org stub
1. **Draft** — Sigma stub in rules/ with ATT&CK tags
2. **Test** — jq replay on FAKE auth.jsonl; document TP/FP
3. **Review** — detection engineer + SOC peer review
4. **Pilot** — YOUR lab SIEM test index / dev cluster only
5. **Tune** — threshold adjustments from purple exercise findings
6. **Promote** — production with change ticket + rollback plan
7. **Retire** — deprecate when ATT&CK technique coverage superseded
Purple exercises feed steps 2 and 5 — not unauthorized sims
EOFCommand — copy this
grep -E 'Draft|Tune|Retire|Purple' "$PURPLE_LAB/notes/rule-lifecycle.md"
python3 -c "print('Rule lifecycle: draft → test → tune → promote with purple feedback')"Primary tools to practice this lesson: grep, python3. Reference sites: Sigma lifecycle (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic rule workflow (https://www.elastic.co/guide/en/security/current/rules-ui.html); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why lifecycle literacy prevents stale detection
Console rules without retirement accumulate false positives. Skipped test stage deploys broken logic. Version-controlled lifecycle ties rule changes to purple exercise evidence.
Students document lab lifecycle on notes — production follows ITSM and detection engineering SLAs.
3. Lab boundary
Forbidden: deploying to production without test and review stages. Allowed: rule lifecycle card — six stages with $PURPLE_LAB fictional rule example.
Ship: rule lifecycle card for YOUR lab rule. Next: Sigma Lab.
4. What you ship: rule lifecycle card for $PURPLE_LAB
Six stages with artifacts and owners. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Rule lifecycle card. $PURPLE_LAB named. File t35-m04-l03-rule-lifecycle.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Deploy rule directly to production SIEM. Never retire noisy rules.
Right
Write rule lifecycle card for YOUR $PURPLE_LAB. Next: Sigma Lab.
Mission: document rule lifecycle on YOUR lab
1) List draft, test, review, deploy, tune, retire. 2) Write lifecycle row with artifact per stage. 3) Assign owner role per stage. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Retire is a stage — deprecated rules in SIEM still fire until removed.
Knowledge Check
APPLY: Rule lifecycle primarily governs:
Multiple choice
Knowledge Check
APPLY: True or False: Test stage uses log replay against lab simulation telemetry.
True or False
Knowledge Check
APPLY: Rule lifecycle literacy on Cyberlium uses:
Multiple choice