Validate Detections with Atomic Red Team (CoPilot)

​

Goal

​

When to use

• After deploying/tuning detection rules
• After telemetry changes (Sysmon, agent configs)

​

Prereqs

• Atomic Red Team available on a test endpoint
• Velociraptor artifacts to execute tests remotely

• Atomic Red Team (detection simulation)

​

Procedure (high level)

1. Pick a safe atomic test
2. Execute it via CoPilot/Velociraptor
3. Confirm the expected alert fires
4. Tune rules/telemetry if needed

​

Validation

• Alert fires and is visible in the expected UI surface(s)