Write and Test a Detection Rule
Create a transparent local rule for one pattern in the synthetic dataset.
Create a transparent local rule for one pattern in the synthetic dataset.
Prepare 20m · Build 110m · Verify 30m · Document 20m
Work only inside the folder created by Smartphone-Academy.py prepare detection-rule. Use the supplied samples or systems you personally administer.
Prepare the Termux workspace
Open Termux in the Academy root and prepare this lab with the local companion. It creates safe samples, notes and evidence files under your Termux account.
python Smartphone-Academy.py prepare detection-ruleNo root. Use the supplied files and keep the workspace under $HOME.Practical mission
- Describe the behavior before writing the expression
- Build positive, negative and boundary test events
- Measure true and false matches on the supplied sample
- Tune once and document the trade-off introduced
A rule specification, test corpus, expected results and tuning record.
Quality gate
Analyst reflection
Which result from “Tune once and document the trade-off introduced” would need more evidence before it could support an operational decision?
After checking the evidence, run python Smartphone-Academy.py complete detection-rule. Progress is stored locally in the Termux home directory.