My Role
Detection engineering and security product developer
All Projects
Interactive security labLatest release case study
Sentinel Rules Studio
Detection Engineering Workbench
Detection engineers need to write, test, and explain rules against representative telemetry before promoting them into monitoring workflows.
Interactive preview
Full demoWhat I Built
Detection authoring and regression workbench that evaluates Sigma-style rules against a labelled event corpus, reporting precision, recall, and per-event outcomes so the cost of broadening a condition is measurable instead of assumed.
Evidence
Working interface, documented system behavior, and implementation-level decisions.
Technical Architecture
From system input to explainable output.
The control gate is shown as a first-class stage, not an afterthought added around the workflow.
Technical Decisions
- Built a rule evaluator that runs field matchers with equals, contains, and endswith modifiers against a normalised event schema, mirroring how Sigma rules compile in a real SIEM.
- Implemented filter clauses so a rule can express 'match this except when', which is how a legitimate backup agent stops generating credential-access alerts.
Security Considerations
- The public case study makes no additional security claim beyond the documented controls shown in the architecture.
Outcome & Evidence
- Surfaced the specific reason for every wrong outcome, since 'the rule is too narrow for this variant' is actionable and a precision percentage is not.
Detection EngineeringSigmaMITRE ATT&CKSIEMPrecision & RecallThreat Detection
Working product
Try the interactive demo.
The product experience is part of this case study. Explore it here, reset its state, or switch viewport sizes without leaving the project page.
sentinel-rules-studio.zainkhalilkhan.com
Sentinel Rules Studio
Security platform
Sandbox telemetry
Sentinel Rules StudioWorkspace3 updates
Sentinel Rules Studio · Detection Testingrule quality: precision and recall against a labelled corpus
P 100 · R 50
Detection engineering is a precision and recall problem, not a rule-writing problem. Each rule here is evaluated against a labelled event set so the cost of broadening a condition is visible: the single-condition rule catches everything and alerts on everything.
Rule quality1 alerts fired
100%precision
50%recall
True positives
1
malicious and alerted
False positives
0
benign and alerted
Missed
1
malicious, no alert
ATT&CK
T1059.001
mapped technique
Rule source
detection:
selection:
Image|endswith: powershell.exe
CommandLine|contains: -enc
ParentImage|contains: Office
condition: selection
Three conditions ANDed. Any one alone is far too noisy to alert on.
Corpus outcomes5 events
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.
Next Case Study