A county wants to catch detection regressions by replaying historical municipal alerts against new rules. What automation practice is that?

A county that wants to catch detection regressions by replaying historical municipal alerts against new rules is automating detection regression testing by replaying those historical alerts against the new rules. Historical corpora encode civic truths the SOC already handled; replaying them shows whether a rewritten or AI-assisted rule still catches yesterday’s confirmed hits without exploding on known benign patterns. Automation makes that check routine in the detection pipeline instead of an occasional manual memory test. Why the other options fail by concept: Automating detection regression reporting by replaying historical municipal alerts against new rules produces reports on replay outcomes, but it does not execute the regression test that shows whether new rules still catch past confirmed hits. Automating detection regression syntax checks by replaying historical municipal alerts against new rules checks syntax only; it does not evaluate whether new rules still catch past confirmed hits or hold down known-benign noise to catch detection regressions. Automating detection regression enrichment by replaying historical municipal alerts against new rules adds context to guide triage, but it does not test new rules against past alerts to reveal detection regressions. Exam caveat: replay corpora must be sanitized and access-controlled—historical municipal alerts can contain sensitive citizen or employee data. Operational check: on each detection PR, run automated replay against a labeled civic alert set, fail the build if confirmed-true positives are missed or if known-benign volume exceeds the agreed noise budget, and retain replay reports with the change record.