opentide-detection-rule
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation and authoring guide for Managed Detection and Response (MDR) artefacts. Its instructions are consistent with the stated purpose of creating deployable security rules.
- [SAFE]: All query examples (KQL, SPL) and YAML structures provided are illustrative for security monitoring and incident response procedures. They use standard placeholders such as
{{UserPrincipalName}}and{{columnName}}rather than hardcoded credentials. - [SAFE]: The containment guidance (e.g., account disabling via Entra ID) is presented as analyst procedure metadata within a detection rule context, which is standard practice for MDR platforms.
- [SAFE]: Platform configurations for Sentinel, Splunk, and Defender for Endpoint are well-documented and follow vendor-standard schemas without requesting excessive permissions or performing hidden network operations.
Audit Metadata