title: CodersSecret Toy Northstar Release Review
id: ae0bb2ee-9b90-4543-985c-25d11be8b6c5
status: test
description: Detect the documented release-review marker in instructor-authored synthetic logs. A match is not a malware verdict.
author: CodersSecret course project
date: 2026-08-25
modified: 2026-08-25
references:
  - fixture-manifest.json
logsource:
  product: coderssecret-course
  category: synthetic-release-events
detection:
  selection:
    EventSource: course-fixture
    EventAction: toy_release_review
    Marker: NORTHSTAR_RELEASE_REVIEW
  condition: selection
fields:
  - EventId
  - Timestamp
  - Hostname
  - CandidateVersion
  - ProvenanceState
falsepositives:
  - An instructor-authored positive fixture intentionally exercises this rule.
level: low
tags:
  - course.synthetic
  - course.release-integrity