Detection Engineering.
under “easier said than done” in some organizations, but at least don’t open tickets based on test alerts, will ya?). For example, this tool on GitHub provides the capability to test a YARA-L (used by Chronicle SIEM) rule by running it over logs that have been ingested and returning any matches