Detection engineering is, in my experience, a discipline of constant adaptation. The environment changes, adversaries adapt, and our understanding of their behavior also deepens. Our detections must evolve with them, but so must our understanding of why they work the way they do.
A detection can improve over time while becoming harder to understand. Every change reflects a decision, often made by different engineers across a chain of handoffs.
Take a detection you’ve inherited. On the surface, there is nothing to fault. The logic holds up and the false positive ratio is 0.6. Yet at one time it was 0.85. Someone made a call to alter that, but why?
Was it a spike in false positives that forced a more conservative rule? A shift in the environment? New threat intel that made the old logic look too wide? Or just an effort to quiet the alerts on a Friday afternoon? You can't tell. The person who changed it left six months ago. There's no ticket. The Slack thread where it was discussed lived in a channel that no longer exists.
The change survived but the context behind it did not.
Rollbacks and diffs are only the “what” Git gives you differences. Most SIEMs give you a rollback button. If that's all "versioning" means, plenty of vendors already have it.
What they don’t seem to provide is the why . Not just what the query looked like last month, but what problem someone was solving when they changed it, what they tried before that didn't work, and what they were worried about breaking. That's the part that actually determines whether the next person tunes the rule well or repeats a mistake that already happened once.
Nebulock Detection Versioning addresses this part by treating reasoning as part of the detection.
Preserving the “why” behind the change Nebulock's Detection Versioning helps detection engineers, security analysts, and operators understand the judgment that went into detection updates. Saving a detection doesn't overwrite the past. Instead, Nebulock creates a new version holding the full state at that moment: logic, MITRE mappings, severity, metadata, and an AI-generated assessment of what the change actually does to detection behavior.
Detections now show version history and change impact summaries
Key features of Detection Versioning include:
Timeline view showing every version of a detection.Side-by-side diff comparing any two versions to see exactly what changed.Journal entries with author documentation. AI-generated Change Impact assessment explaining what the edit actually does to detection behavior.The ability to revert to any previous version without losing history because the versions in between stay on record. Here's what a detection’s journal entries look like in practice, on a real rule:
Version 4. A retrohunt turns up 340 false positives, almost all tied to a specific EDR agent's benign process injection behavior during software updates.Version 5. An exclusion is added scoped to that EDR's update signature. The impact assessment flags that this narrows detection coverage by an estimated 4%, concentrated entirely in the false positive cluster identified in the retrohunt.Version 6. Three months later, new telemetry shows the original detection threshold was too conservative in the other direction, missing a slower variant of the technique. The threshold moves again, and the assessment notes this reopens some of the noise the Version 5 exclusion had suppressed. A tradeoff an engineer can now see and decide on explicitly, instead of rediscovering it by accident.Open the Journal on that rule and this entire arc is right there, in order, and attributable. Compare any two versions to see exactly what moved.
Detection Versioning helps teams troubleshoot faster, harden detections over time, and make audit and compliance easier. And because reverting is safe, teams get more room to experiment with more aggressive tuning. If a change doesn't hold up, branch off an earlier one without losing anything either version learned.
The detection is now as much a record of its own making as it is its present logic.
Turn failures into feedback loops AI gets things wrong. So do humans. The best learning for both comes from failure: what was tried , what happened , why it didn't work . Today, that knowledge is almost never captured. You revert, you move on. Six months later, someone (or some agent) has the same idea and tries it again, unaware it already failed.
When you ask the Detection Agent to tune a rule, it proposes changes. You review, save a new version, run a retrohunt, and sometimes go through a few failed iterations before it's what you want.
With Detection Versioning, those failed attempts don't disappear. They stay on record, visible to the next engineer or the next agent, turning tuning into a feedback loop instead of a string of disconnected decisions that nobody remembers making. Nebulock turns failure into memory to make your agentic detection program smarter and faster over time.
Built on ADEF, made practical This is effectively the Govern and Evolve stages of FORGE lifecycle within the
Agentic Detection Engineering Framework (ADEF) :
Govern gives you full auditability: who wrote, updated, and reverted what, and when, traced from the person who made the call through the retrohunt they ran to the production deployment. Evolve recognizes that detections have to change as attacks and environments shift, and makes that adaptation visible instead of assumed.Where ADEF captures this reasoning in Markdown journals, Detection Versioning brings the same discipline into the platform itself. The retrohunt results, the Change Impact assessment, and the full diff between any two points are attached directly to the rule instead of living in a separate document someone has to remember to check.
Try it on a rule you already have Detection Versioning is live for all Nebulock detections. Existing rules start versioning automatically from your next save without any migration or setup required.
To apply it in your environment, open the Journal on your oldest detection rule. See if you can still explain why the current version looks the way it does. If you can't, you found the gap we set out to close.
If you want to learn more about how Nebulock is changing detection engineering and threat hunting, book a live demo today.
