Product Tour · Final Step

Detection Engineering — Rules as Code, Coverage as a Metric

Step 8 of 8

app.manysignal.io/rules/aws-s3-public-acl-set/edit

Rule YAML

id: aws-s3-public-acl-set
version: 1
kind: filter
severity: high
ocsf_class: api_activity
mitre_attack: [T1530]

filter:
  all:
    - field: cloud.provider
      op: eq
      value: "AWS"
    - field: api.operation
      op: in
      values:
        - PutBucketAcl
        - PutBucketPolicy
    - field: api.request.acl
      op: contains_any
      values:
        - public-read
        - public-read-write

triage_hints:
  - "Is this bucket a CDN origin?"
  - "Was a change ticket open?"

Test Results

s3-public-acl-match.json MATCH

s3-put-object-no-acl.json NO MATCH

s3-get-object.json NO MATCH

MITRE ATT&CK Coverage

TA0001

TA0002

TA0003

TA0005

TA0008

TA0009

TA0010

TA0011

Coverage: 62% of active techniques

Rule-as-code with live testing

Write detection rules in YAML, run them against fixture events in the browser or CLI, and see match/no-match results immediately. No need to ingest test data into a live environment.

MITRE ATT&CK coverage map

Every rule you write is automatically mapped to MITRE ATT&CK techniques. The coverage map shows which techniques your rule library covers, where gaps exist, and what priority areas to tackle next.

Staged deployment: alert-only to active

Deploy in alert-only mode first — findings are generated but no response actions run. Review triage verdicts for 24-48 hours, then promote to active once you are confident in rule accuracy.

Entity Graph

Tour complete. Ready to see ManySignal in your environment?

Request a demo Read the docs