What's included in detection rule documentation?

Each rule includes MITRE ATT&CK mapping, technical description, false positive guidance, tuning recommendations, investigation playbooks, and validation evidence showing the rule triggering against real attacks.