OpenTide Detection Rule (MDR)

An MDR is the deployable artefact — the detection rule that runs on a specific platform. It implements a DOM signal and carries the response metadata that guides analysts when the rule fires.

Preconditions

1. Hydrate Schemas/Templates for MDR (e.g. mdr::2.1 — always check the live template for the current version) and compare with active JSON schemas.
2. Confirm DOM linkage integrity — the signal you operationalise must exist and remain authoritative.
3. Consult tenant Configurations/systems to know which backends are licensed and routed through CoreTide deployments.

Complete field reference

Top-level