Rule Lifecycle
Rule lifecycle literacy names draft, test, review, deploy, tune, retire stages — document lifecycle on YOUR $PURPLE_LAB before production rule changes.
Visual · t35_rule_lifecycle
Rule lifecycle literacy. $PURPLE_LAB only. Original Cyberlium.
Rules age like milk — literacy teaches lifecycle stages so detection stays accurate through purple exercise feedback.
Rule lifecycle flows draft → test → peer review → deploy → monitor → tune → retire. Draft: author Sigma in Git branch. Test: replay logs on lab hosts, measure TP/FP. Review: PR with detection engineer sign-off. Deploy: pipeline to lab then production SIEM. Tune: purple exercise findings trigger updates. Retire: deprecate when telemetry or threat landscape changes. Cyberlium writes lifecycle row on YOUR $PURPLE_LAB — map six stages for one fictional rule with owner and artifact per stage. Next: Sigma Lab.
1. Lifecycle stages (named)
Draft: Sigma YAML in feature branch with ATT&CK tags. Test: log replay against lab simulation telemetry, FP baseline check. Review: PR approval, lint pass, peer comment. Deploy: tagged release to lab SIEM, then production after purple sign-off. Tune: update from exercise gaps. Retire: status deprecated, removal ticket.
On $PURPLE_LAB, write lifecycle row — stage, artifact, owner for one fictional T1059 rule.
Command guide
Try these commands — Lifecycle stages (named)
═══ LINUX / macOS (Terminal Practice) ═══
Check system state and user context
Command — copy this
id whoami uname -a
Inspect network sockets listening for connections
Command — copy this
ss -tuln 2>/dev/null || netstat -tuln
Audit active processes
Command — copy this
ps aux | grep -v "\[" | head -15
═══ WINDOWS (POWERSHELL) ═══ Query user identity and system information
Command — copy this
whoami /all Get-ComputerInfo | Select-Object CsName, OsName, OsVersion
Primary tools to practice this lesson: grep, python3. Reference sites: Sigma lifecycle (https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide); Elastic rule workflow (https://www.elastic.co/guide/en/security/current/rules-ui.html); NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why lifecycle literacy prevents stale detection
Console rules without retirement accumulate false positives. Skipped test stage deploys broken logic. Version-controlled lifecycle ties rule changes to purple exercise evidence.
Students document lab lifecycle on notes — production follows ITSM and detection engineering SLAs.
3. Lab boundary
Forbidden: deploying to production without test and review stages. Allowed: rule lifecycle card — six stages with $PURPLE_LAB fictional rule example.
Ship: rule lifecycle card for YOUR lab rule. Next: Sigma Lab.
4. What you ship: rule lifecycle card for $PURPLE_LAB
Six stages with artifacts and owners. $PURPLE_LAB named. chmod 600.
5. What you record before the next lesson
Date. Rule lifecycle card. $PURPLE_LAB named. File t35-m04-l03-rule-lifecycle.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR purple lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Deploy rule directly to production SIEM. Never retire noisy rules.
- Right: Write rule lifecycle card for YOUR $PURPLE_LAB. Next: Sigma Lab.
Mission: document rule lifecycle on YOUR lab
1) List draft, test, review, deploy, tune, retire. 2) Write lifecycle row with artifact per stage. 3) Assign owner role per stage. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Retire is a stage — deprecated rules in SIEM still fire until removed.
APPLY: Rule lifecycle primarily governs:
APPLY: True or False: Test stage uses log replay against lab simulation telemetry.
APPLY: Rule lifecycle literacy on Cyberlium uses: