Portable Intent vs Backend Semantics

Portable content is not portable telemetry

A shared rule refers to process creation and a parent image. One environment records both fields from an endpoint sensor. Another records only process name. The same rule text cannot create evidence that the second source never observed.

Portable content describes analytical intent using a shared model. It depends on a log source, field semantics, types, event granularity, time, and local scope. Portability helps people exchange and review ideas; it does not remove those dependencies.

Write the intended behavior and evidence relationship beside the rule. State which actor, action, target, outcome, and context the fields are meant to represent. That explanation remains the reference when a backend expression appears valid but behaves differently.

Translation changes more than syntax

Converters map field names, operators, functions, wildcards, escaping, lists, case behavior, and sometimes pipelines. Backends differ in null semantics, tokenization, type coercion, timestamp choice, aggregation, cardinality, and supported correlation.

A condition that excludes one value may also exclude missing fields in one backend and retain them in another. A wildcard can match path separators differently. A case-insensitive comparison can become case-sensitive. These are changes to match population, not cosmetic formatting.

Record converter, pipeline, mapping, backend, and target-language versions. Treat warnings and unsupported features as failed assumptions requiring an explicit decision, not messages to suppress so compilation turns green.

Field mappings are security interpretations

A portable actor field may map to the authenticated user in one source and the target account in another. A process command line can be absent, truncated, tokenized, or protected. A network destination can mean proxy, remote service, or translated endpoint.

Map from source semantics to the portable concept and then to backend field. Preserve source identifiers and the rationale. One portable log source may require separate local mappings for different producers rather than one broad alias.

Test missing, empty, multi-valued, differently typed, and provider-specific cases. If the mapping cannot preserve a distinction needed by the logic, narrow support or create a separate implementation. False universality is worse than explicit local scope.

Execution policy also changes the result

Schedule, lookback, event delay, state retention, deduplication, suppression, risk weighting, routing, and tenant scope sit outside many rule formats. Two platforms can run semantically similar queries and still produce different alerts.

Preserve the runtime contract with the content. A ten-minute sequence needs event-time semantics, sufficient state, and late-data behavior. A rule deployed hourly with a five-minute lookback creates gaps even if the query is perfect.

The detection metadata should name dependencies, owner, tested targets, expected output, delivery, and limitations. A portable file without its operating context is an incomplete detection artifact.

Test claims across targets, not counts alone

Use representative intended behavior, benign alternatives, null and boundary cases, duplicates, late events, and source-specific variants. Compare which records match and why. Equal total counts can hide different populations; different counts can be legitimate when local scope is explicit.

Keep golden source events and expected analytical decisions separate from target query snapshots. The first protects intent. The second reveals converter and backend change. Review both after mapping, converter, schema, or platform upgrades.

The honest portability statement names the targets and versions whose semantics were tested, the sources and populations supported, and the known gaps. “Portable” then means transferable and reviewable—not magically identical everywhere.