CERBERUSDetection Rule Health
Public beta Runs on your machine Free ยท MIT

Know which detection rules still work.

One local overview of your Microsoft Sentinel analytics rules and Defender XDR custom detections: how each rule performs, and whether the values it depends on still exist in your data.

Quick start Setup guide View on GitHub 
docker run -d --name detectionrulehealth \
  -p 127.0.0.1:5180:5180 -v drh-data:/data \
  --read-only --tmpfs /tmp --cap-drop ALL \
  --security-opt no-new-privileges \
  ghcr.io/cerberus-cyber-consulting/detectionrulehealth:beta
Detection Rule Health overview page with demo data: rule efficacy chart and value-check status

What it shows

Two questions per rule

Efficacy

Is it worth its noise?

Incidents per rule and the true positive, benign positive, false positive, undetermined and open split. Counts sit next to every rate, and rules with too few classified incidents are marked as such.

Value checks

Can it still fire?

Every literal a rule compares against, such as ActionType == "LogonFailed", is extracted with Microsoft's KQL parser. You choose which values must always occur; the app checks your data and flags the ones that disappeared.

Stays local

Your tenant, your machine

A container on your computer, your own sign-in, results in your own volume. No backend, no telemetry, tokens in memory only. Privacy statement.

How it works

From container to overview in three steps

Run the container

One docker run or docker compose up. Works with Docker Desktop, Docker Engine, Podman and Rancher Desktop, on x64 and Arm.

Choose your sign-in

Recommended: your own single-tenant app registration with read-only delegated permissions (script or portal, no secrets). Quick start: sign in through Microsoft's own apps, no registration needed.

Follow the wizard

Open http://localhost:5180, sign in with Microsoft, pick your Sentinel workspaces and collect. Then decide which values to validate.

Built for detection engineers

What you get in the beta

  • Sentinel analytics rules (scheduled and NRT) and Defender XDR custom detections side by side
  • Efficacy from SecurityIncident and Defender XDR incidents, per rule
  • Value extraction with lineage through let, joins and unions, and a workbench to mark values as validate or ignore
  • Validation against up to 30 days of your own data, through Log Analytics or advanced hunting
  • Demo data to explore before you connect a tenant

Good to know

Beta limits

  • Read-only: the app never changes rules or incidents.
  • Rates are only as good as how consistently incidents are classified.
  • Values computed at runtime (watchlists, toscalar()) are listed but not validated.
  • Data formats may still change between beta versions.

Report an issue or suggest an idea, without tenant data please.