> For the complete documentation index, see [llms.txt](https://0xzoro.gitbook.io/0xzoro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xzoro.gitbook.io/0xzoro/soc-operations/detection-engineering/04-toml.md).

# 04 toml

> **Course:** TCM Security — Detection Engineering\
> **Notes standard:** see [Detection Engineering Note-Taking Skill](broken://pages/28f9a000c99d2b8a9ccb58770e3faedf4f7a7384)\
> **Scope:** Detections as TOML — the rule schema, Elastic rule templates, MITRE threat objects, schema validation, and managing many rule files.

***