A detection title is not the rule id

The title is the display name

The title is the sentence people see in the queue. It can be edited, translated, or shared by two drafts that are not the same rule. A matching title is a matching label, not a matching identifier.

Quote the title when you describe what the queue showed. Do not use it as the only key in a ticket that has to find the rule again next week.

The id is the stable key

The rule id is the identifier stored on the rule and copied onto the alert. Two alerts with the same id are the same rule. Two alerts with different ids are different rules, even when the titles are identical.

If the paste has a title and no id, write that the id was not in the paste. Do not invent one from the title words.

What the case file keeps

File the rule id and the title on separate lines. When you close or tune a rule, name the id. Closing the title string does not close a second id that happens to share it.

Lab: two titles and two ids

A lab queue shows two alerts, both titled New local admin on a workstation. The ids are HB-DET-014 and HB-DET-022. A draft files one rule because the titles match, and closes both by editing that one title.

The note lists both ids under the shared title. They are two rules. A change to HB-DET-014 does not change HB-DET-022. The title stays a label.

title: New local admin on a workstation
id: HB-DET-014
id: HB-DET-022
write: one title, two rules
not: one rule because the titles match