aertunmanual

Detection rules, Sigma and correlations

Rules with fixtures, Sigma import, a trial ring, and suppressions that end.

In the consoleDetections

  1. Install the shipped rules

    aertun detect pack install
aertun detect test

    Each rule carries fixtures it must match and must not, MITRE ATT&CK technique IDs, and a line on what it does not catch.

  2. Bring your own, in the open standard

    aertun sigma import ./rules

  3. Trial a rule before it reaches the queue

    aertun detect ring RULE trial --because "new rule"
aertun detect stats
aertun detect ring RULE live --because "a week without a false positive"

    In the trial ring a rule records what it would raise, and its record earns it the queue.

  4. Suppress, until a date

    aertun detect suppress RULE user.name=svc-backup --owner dana --until 2026-12-31 --because "known job"

Correlations raise a finding about several events across rules and platforms, once their window closes; aertun correlate demo shows one end to end.