Engineering
2026-01-30 Writing detections that explain themselves
An engineering note on the 'hypothesis-first' rule we use for every detection that ships in Vector.
S
S. Ramírez 7 min read A detection is a hypothesis. If it fires without the hypothesis attached, you're asking an analyst to reverse-engineer your thinking at 3am.
The rule
Every Vector detection ships with three fields, non-negotiable: hypothesis, evidence, next step.
Hypothesis
One sentence, written in English, that describes what we think is happening. Not the rule. The claim.
Evidence
The specific data points the detection saw. Not a whole log line. The fields that mattered.
Next step
The single action the analyst should take. Not a menu of options. The recommendation.