Add structured detection runbooks

[jusso-dev]

Problem

Rules currently expose metadata and false-positive notes, but the investigation steps are not structured enough for consistent analyst execution or AI-assisted triage.

Scope

Add structured runbooks to detection rules and make them visible in detection detail, alert detail, and triage workflows.

Implementation Notes

• Extend detection metadata with a runbook object: summary, initialQuestions, investigationSteps, benignExplanations, containmentConsiderations, requiredEvidence, tuningGuidance, references.
• Update Sigma import to preserve runbook-compatible metadata if present.
• Add default runbook templates for existing starter rules.
• Show runbook content on alert detail when the alert has a matched rule.
• Let triage and detection drafting consume runbook fields as trusted context.

Acceptance Criteria

• Existing rules render with a runbook section even if only a minimal template exists.
• Alert detail shows the matched rule investigation steps.
• Playbook tasks can be created from runbook required evidence.
• AI triage output cites the runbook when it uses runbook content.
• Detection pack validation warns when high-severity rules have no runbook.

Tests

• Unit test runbook schema validation.
• Unit test detection pack validation warning for missing high-severity runbook.
• UI test alert detail renders matched runbook steps.
• Workflow test required evidence can seed case tasks.

[m13v]

structured runbooks fix the consistency gap and give triage a citable source, agreed. the boundary they don't touch is execution: requiredEvidence still names what to pull, not who pulls it, so a high-severity alert turns the runbook into a checklist an analyst works by hand across the SIEM, the cloud console, and the IdP. the AI cites investigationSteps cleanly but the evidence-gathering across those tools stays manual unless something actually runs the lookups.