Detection Rule Health 0.1.0-beta.2

Changed

• The documentation site moved to https://detectionhealth.cerberuscyberconsulting.com. Links in
  the app, README, container image label, release notes and setup script point there; the privacy
  statement names the new address.
• The first-run guide shows the rule detail page, with absent and present values highlighted in the
  rule query.

Fixed

• Styles, scripts and images on the documentation site did not load on the custom domain.

Image

docker pull ghcr.io/cerberus-cyber-consulting/detectionrulehealth:0.1.0-beta.2

Digest: sha256:476349ed2d80ff675903628eb843891f517ec0078241010c2b4a0f4218cc06e7 (linux/amd64, linux/arm64). Verify with
gh attestation verify oci://ghcr.io/cerberus-cyber-consulting/detectionrulehealth:0.1.0-beta.2 -R Cerberus-Cyber-Consulting/DetectionRuleHealth.

Setup guide: https://detectionhealth.cerberuscyberconsulting.com/setup/

Detection Rule Health 0.1.0-beta.1

First public beta.

Added

• Overview of Microsoft Sentinel analytics rules and Defender XDR custom detection rules in one place.
• Efficacy per rule: incidents created and the true positive, benign positive, false positive,
  undetermined and open split, with counts next to every rate.
• Value checks: literal values in rule queries are extracted with Microsoft's KQL parser; you choose
  which values must always occur, and the app checks that they still do in your data. This includes
  values in graph-match conditions of Exposure Management rules (SourceNode.NodeLabel == "device").
  Standard Log Analytics columns such as Type and _ResourceId are known on every workspace table,
  so rules that use them no longer show a false bind error.
• Container image for linux/amd64 and linux/arm64 on GitHub Container Registry, signed, with SBOM
  and provenance.
• Browser sign-in (authorization code with PKCE) with your own app registration (recommended), or
  without one through Microsoft's own apps, Microsoft Graph Command Line Tools and Microsoft Azure
  PowerShell (quick start). The setup guide explains what each choice means for consent. Tokens stay
  in memory only in both cases.
• Setup wizard: app registration details, sign-in, workspace selection and first data collection.
  A tenant ID can be entered as a domain (contoso.onmicrosoft.com). The wizard picks up where you
  left off.
• Data collection shows each stage as it runs. A source your account may not read (for example no
  Microsoft Sentinel role) is reported with the missing role or permission; the other sources are
  still collected.
• Settings page per tenant: display name, incident and validation windows, workspaces, sign-in and
  sign-out, collect again, and remove the tenant with its data.
• Demo data to explore the app before connecting a tenant. It is read-only.
• Daily check for a newer release on GitHub (turn off with RULEHEALTH_UPDATE_CHECK=false).
• Documentation site, privacy statement and security policy.

Image

docker pull ghcr.io/cerberus-cyber-consulting/detectionrulehealth:0.1.0-beta.1

Digest: sha256:f658092cbc7e82706cf6e53ffd511d1cb68b8e8f5b7c1fb287828ff9a7b16e44 (linux/amd64, linux/arm64). Verify with
gh attestation verify oci://ghcr.io/cerberus-cyber-consulting/detectionrulehealth:0.1.0-beta.1 -R Cerberus-Cyber-Consulting/DetectionRuleHealth.

Setup guide: https://cerberus-cyber-consulting.github.io/DetectionRuleHealth/setup/