Do you just write rules, or do you test them?

We validate every detection against real attack execution. If the rule doesn't fire reliably against the technique it's designed to detect, we don't deliver it.