Community Detection Rules

Security intelligence
built by practitioners

Submit a pull request. We review it. Vetted rules ship in signed content updates — no forum, no moderation queue, no extension system.

Aperlock/chronolith-detection-rules
104 rules shipping in Chronolith now
MITRE ATT&CK mapped
Sigma-compatible format
Signed content updates — no code execution
Why this model

Community rules. Aperlock quality.

We want the practitioner community to contribute detection logic. We don't want to run a forum, and we don't want untrusted code running inside your clients' SIEMs.

Rules are data, not code
Detection rules in Chronolith are structured JSON/YAML definitions — event filters, thresholds, and correlation logic. They're reviewed and shipped as signed content updates, not executable extensions. A bad rule can't compromise your deployment. Read the brief →
PR-based, not forum-based
You already live in GitHub. A pull request is a natural workflow for security practitioners. Built-in version history, diff review, and discussion threads — without a moderation queue or spam problem.
Aperlock reviews and ships
Every rule that ships in Chronolith is Aperlock-reviewed. The merge is the vetting — if we merge it, it's ours. Community contributors get credit, and the quality bar stays consistent across all deployments.
Contribution process

How to contribute
a detection rule

  • 1
    Fork the repository
    Fork Aperlock/chronolith-detection-rules. Clone locally.
  • 2
    Write your rule
    Use the YAML schema in RULE_SCHEMA.md. Map to MITRE ATT&CK where applicable. Include test cases in /tests/.
  • 3
    Open a pull request
    PR title format: [RULE] Rule name — ATT&CK tactic. Describe the threat scenario, detection logic, expected false positive rate, and any tuning notes.
  • 4
    Aperlock review
    We test against our reference environments and review for false positive rate, performance impact, and SME relevance. Feedback in the PR thread. Target: 5 business days.
  • 5
    Ships in a signed content update
    Merged rules ship to all Chronolith deployments in the next signed content release. Your GitHub handle is credited in the rule metadata. No user action required on the deployment side.
rules/T1110_brute_force_extended.yaml YAML
id: "A-101"
name: "Brute Force — Cross-Host Spray"
author: "community"
mitre_technique: "T1110.003"
severity: "HIGH"
description: |
  Same credential attempted across
  5+ distinct hosts in 10 minutes.

filter:
  event_type: "FAILED_LOGON"
  min_distinct_targets: 5
  window_minutes: 10
  group_by: "src_user"

false_positive_rate: "low"
tuning_notes: |
  Raise min_distinct_targets to 10
  in large environments with roaming
  profiles or shared accounts.

# test cases in tests/T1110_003_test.yaml
Review criteria

What gets merged

We're not trying to be gatekeepers. We're trying to keep the quality bar high enough that MSPs can deploy every rule without tuning.

✓ We merge
Behaviorally-grounded detections
Rules based on attacker behavior patterns from real incidents — not signatures. Includes a clear threat scenario description and expected MTTD improvement.
✓ We merge
SME-relevant coverage
Rules that address threats commonly faced by law firms, financial services, or healthcare clients at the 50–700 user scale. ICP-appropriate, not enterprise-only.
✓ We merge
Documented false positive profile
The PR honestly characterizes false positive rate and includes tuning guidance. We'd rather have an honest "medium FP rate" with good tuning notes than a misleadingly clean rate.
✓ We merge
Test cases included
A YAML test fixture in /tests/ that demonstrates the rule fires on the intended pattern and doesn't fire on the documented benign cases.
✗ We won't merge
Signature-based detections
Rules that match specific file hashes, IP addresses, or domain names without behavioral context. These age out immediately and create false confidence.
✗ We won't merge
Enterprise-only rules
Rules that require infrastructure (e.g. dedicated honeypot hosts, specific EDR telemetry) that SME clients at 50–200 users don't have. Chronolith is not Splunk Enterprise.
Repository live

Get notified when
new rules ship

The detection rules repository is open. Drop your email and you'll be in the first wave to hear about new contributor rules shipping in signed content updates.

Or watch the repo directly at github.com/Aperlock/chronolith-detection-rules