Draft detection rules from alerts or hunt results

[jusso-dev]

Problem

Detection engineering currently supports existing Sigma-style rules, imports, summary rules, and telemetry testing. Analysts still need a guided path from suspicious behavior observed in a hunt or alert to a proposed detection with tests and tuning notes.

Scope

Add a detection drafting workflow that can start from an alert, selected hunt records, or a plain-language description. The workflow should produce a proposed rule, test fixtures, ATT&CK mapping, false-positive notes, and a runbook draft.

Implementation Notes

• Add a draft entity such as soc_detection_draft.
• Supported draft formats for the first pass: YAAQL detection, Sigma-style YAML, summary rule manifest fragment.
• Draft output fields: title, description, severity, query or sigma, mitreTechniques, testRecords, expectedMatches, falsePositives, runbook, tuningNotes.
• Add Draft detection from this alert on alert detail.
• Add Draft detection from results on Hunt.
• Add a review screen under Detections before anything is enabled.
• Reuse existing rule import/test paths instead of bypassing them.

Acceptance Criteria

• A draft can be generated from one alert and includes the alert as a positive test.
• A draft can be generated from hunt results and includes sampled positive/negative fixtures when available.
• Drafts are not enabled by default.
• The reviewer can edit the draft before importing or saving it.
• Imported rules go through existing validation and test status flows.

Tests

• Unit test draft schema validation.
• Unit test alert-to-draft fixture extraction.
• Integration test importing a draft runs existing detection validation.
• API test only detection managers can create or import drafts.