Detection Rule Tester
Validate your detection logic against sample event payloads before deploying to production. Catch false positives before they become noise.
- Accepts ManySignal DSL and Sigma YAML v2 rules
- 80+ built-in sample events for common sources
- Shows field extractions and match reasoning
- Supports negation, filter conditions, and aggregation rules
Rule
detection "okta_impossible_travel" {
title = "Okta Impossible Travel Login"
severity = "high"
mitre = ["T1078.004"]
source "okta" {
event_type = "user.session.start"
}
correlate {
entity = "actor.user.name"
window = "2h"
condition = "geo_distance_km > 800"
}
} Event payload
{
"event_type": "user.session.start",
"actor": {
"user": { "name": "alice@example.com" }
},
"client": {
"geographicalContext": {
"city": "London",
"country": "GB",
"lat": 51.5074, "lon": -0.1278
}
},
"outcome": { "result": "SUCCESS" },
"displayMessage": "User sign on to Okta",
"@timestamp": "2025-08-09T14:23:41Z"
} Second login from Berlin (52.52°N, 13.40°E) within 47 minutes of prior login from London (51.51°N, -0.13°E). Calculated travel distance: 938 km. Minimum travel time by commercial flight: 2h 15m. Impossible at stated interval.
How this tool works
Paste your detection rule
Input a ManySignal DSL rule or a Sigma YAML rule into the rule editor. The tester validates syntax before running.
Paste a sample event payload
Provide a JSON event or choose from the built-in sample event library for popular sources (Okta, CloudTrail, GitHub Audit, M365, Kubernetes).
Review the match result and field extractions
The tester shows whether the event matches the rule, which fields were extracted, and the reasoning for the match or non-match decision.
What to do with the result
Test before deploying
Always validate a new rule against at least one true-positive and one true-negative sample before promoting it to production.
Build a test suite
Store your sample events alongside your rule source in your detection-as-code repository as automated regression tests.
Catch false positives early
Test rules against known-good baseline events from your environment to identify tuning opportunities before they create noise in production.
Detection rule tester: frequently asked questions
Does the rule tester connect to my live environment?
No. The tester runs entirely in your browser against event payloads you provide manually. No data from your environment is processed or transmitted.
What rule formats does the tester accept?
The tester accepts ManySignal DSL and Sigma YAML v2. For Splunk SPL, Elastic EQL, or KQL, use the Sigma Rule Converter to convert to ManySignal DSL first.
Where can I find sample events to test against?
The built-in event library contains 80+ sample events from common sources: AWS CloudTrail, Okta system log, Microsoft 365 audit, GitHub Audit Log, Azure AD sign-in, Kubernetes audit, and EDR process events. You can also paste raw events from your own log archives.
Does the tester validate rule syntax?
Yes. Syntax errors are highlighted in the rule editor with line-level feedback before the test runs. Common errors (missing closing brace, invalid field reference, unsupported modifier) are shown with suggested fixes.
Can I test correlation rules that require multiple events?
The free tester evaluates single-event rules. For correlation rules (count > N within window, multi-event sequences), use the 'Multi-event test' tab and provide an ordered array of event payloads to simulate the correlation window.
How does the 'confidence' score work?
Confidence reflects how many required conditions were matched and how closely the event values align with the detection thresholds. High confidence means all conditions matched with good signal. Low confidence flags potential false-positive conditions.
Can I test rules for data sources not in the built-in library?
Yes. Paste any valid JSON event — the tester will attempt field extraction against the rule conditions regardless of source. For OCSF-normalised events, the tester uses the OCSF schema for field path resolution.
Does the tester support negation and filter conditions?
Yes. Filter blocks (exclusion lists, IP allowlists, known-good process allowlists) are evaluated correctly. The tester shows which filter conditions were active and whether they suppressed a match.
Is there a way to run the tester against a large batch of events?
The free tool supports single-event and small multi-event tests. ManySignal's in-platform detection sandbox supports batch backtesting against 30-day historical event slices. Book a demo to see backtest in action.
Test and deploy detections in a production-grade platform
ManySignal's detection sandbox lets you backtest rules against 30 days of historical events. Book a demo.