Skip to main content
Detection rules bridge your SIEM’s detections and your agent’s understanding of what triggered an alert. Every detection rule carries structured metadata and free-form documentation that agents read during investigation.

​
How Rules Are Created

Detection rules are auto-created when alerts arrive. If an alert references a detection rule that doesn’t exist yet, Calseta creates it with metadata from the alert payload. You can then enrich the rule with documentation, MITRE mappings, and more. Rules can also be created manually via the API for pre-populating your detection library.

​
Rule Structure

​
Documentation Template

The documentation field is the primary value of detection rules. A well-documented rule follows this template with all 16 sections:
All 16 sections should always be present, even if marked “Not applicable.” This gives agents a consistent structure to parse. Use the query language appropriate to your source: KQL for Sentinel, EQL for Elastic, SPL for Splunk.
The quality of your detection rule documentation directly impacts agent reasoning quality. Invest time in documenting false positives, blind spots, and recommended responses.

​
How Agents Use Detection Rules

When an agent retrieves an alert (via REST or MCP), the associated detection rule is included in the response. The agent reads the documentation to understand:
  • What the detection is looking for
  • What false positives to consider
  • What investigation steps to take
  • What response actions are appropriate
This makes agents context-aware without custom prompt engineering.

​
API Endpoints

​
MCP Access

  • Resource: calseta://detection-rules — list all rules
  • Resource: calseta://detection-rules/{uuid} — get a single rule
  • Tool: search_detection_rules — search by keyword, MITRE mapping, or severity