Developing detections

Detection development in Perpetual is an agent-assisted workflow that produces staged detection changes for you to validate and decide whether to deploy. Incoming threat reports can trigger background detection authoring, or you can develop a detection with Simba in a foreground conversation. Both modes use the same engineering guidance and stop at a changeset under your control.

Threat reports trigger background detection authoring

Perpetual provides an agentic approach to threat-informed defense. A threat intelligence agent processes reports as they arrive to determine which reported behaviors apply to each Space. This analysis relies on each Space's datasets, existing detections, and open content work items to judge whether the reported behaviors warrant new coverage. A behavior warrants new coverage when the agent has sufficient confidence that it is specific enough to detect, the Space has the required datasets, and neither an existing detection nor an open content work item already covers it.

The agent opens a detection opportunity for each behavior that warrants new coverage. Each detection opportunity is a backlog item for developing detection coverage. It combines the relevant datasets, the original threat report, and other context into a clear scope of work.

Each detection opportunity becomes a separate, Space-specific assignment for a content engineering agent. The agent develops a detection for that environment using Perpetual’s detection authoring guide, the Space’s datasets, and the style of detections already saved there. It tests the query against the available data and stages a detection worth reviewing in a draft changeset linked to the opportunity. Some opportunities end without a proposal because the available data or existing coverage shows that a new detection would not add useful coverage.

Simba can develop detections with you in the foreground

If you have a security question or detection requirement, you can talk to Simba directly to develop a detection collaboratively. Simba follows the same rules and conventions and uses the same validation tools as Perpetual's background content engineering agent. During the conversation, Simba can test the detection against the Space's datasets, giving you results to examine and refine together.

When the same detection belongs in several Spaces, Simba can author it in a content pack. The pack provides one managed detection that can run in multiple Spaces, with a controlled per-Space update flow for its installations.

Simba stages proposed content in an active changeset. By default, it uses the changeset you already have open and can create a draft when needed. You can commit the changeset when it captures your intent.

You are in control of proposed detections

Before proposing its work, the content engineering agent validates the detection query and complete changeset. Simba also uses validation results to find and correct errors as you work. Neither can commit a changeset, so their staged changes take effect only after you review and commit them.

Technical validation establishes that the staged content can run without error, but it does not establish that the detection provides the intended coverage or sensitivity. To evaluate those qualities, you can ask Simba to run a proposed detection against historical events, examine the matches with you, and refine its logic or sensitivity. You can also compare task counts across runs to understand the query's relative complexity and cost.

Perpetual preserves the origin of each proposal, which can aid in your review. Background work remains traceable to its detection opportunity and content engineering conversation. Foreground work remains attributable to your conversation with Simba.

Set deploy to decide whether committing the proposed work saves it without running it or starts deployment. A new detection's signal dataset becomes live only after deployment succeeds. When you update a deployed detection, its previous live version remains available until the new version finishes deploying.