This directory contains detection content managed as code.
Microsoft Sentinel detections are organized by ATT&CK tactic-aligned folders.
Reserved for Sigma content where applicable.
Used for ATT&CK and Cyber Kill Chain mapping artifacts.
Detection content should follow repository standards for:
- naming
- lifecycle
- severity
- tagging
- metadata quality
- folder placement
See:
Detections should use one of the following lifecycle values:
- experimental
- testing
- production
- deprecated
See:
The goal of this directory is to manage detection content as structured, governed, and maintainable engineering artifacts.