How do you know your detections actually work?

Test them. Run adversary emulation in your own environment, either atomic tests mapped to technique IDs or a full scenario, and grade each test as prevented, alerted, logged only, or missed. Feed misses into the detection backlog and retest after the fix. Separately, monitor telemetry health continuously, because most detection failures are broken data pipelines rather than flawed rule logic.

A rule that has never fired is a hypothesis. So we ran atomic tests mapped to technique IDs on a schedule, in a controlled segment with the endpoint team on the call, and graded each one as prevented, alerted, logged only, or nothing. Logged only is the most useful category, because it means the data is already there and only the detection is missing, which is a quick win. Every miss became a ticket with the technique ID on it, and the rule was not done until the same test was rerun and it alerted. Twice a year we ran a longer scenario with a full chain rather than atomics, which catches the coordination problems, like the alert firing correctly at three in the morning and nobody having a runbook for it. Separately I watch telemetry health, because the most common reason a detection fails is not the logic. It is a sensor that stopped reporting three weeks ago, so I alert on log source silence per host group.