From 57bf2a7b3a4b384beaf60edf3849e942b5969fa0 Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Sun, 18 Oct 2026 09:25:33 -0400
Subject: [PATCH] fix(detection): run the rule pipeline over nested detections

---
 security/security-threat-detection-engineer.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/security/security-threat-detection-engineer.md b/security/security-threat-detection-engineer.md
index 745c3bf8..b85cae0a 100644
--- a/security/security-threat-detection-engineer.md
+++ b/security/security-threat-detection-engineer.md
@@ -236,6 +236,11 @@ on:
     branches: [main]
     paths: ['detections/**/*.yml']
 
+defaults:
+  run:
+    # bash leaves globstar off, so detections/**/*.yml would only match one level deep
+    shell: bash -O globstar -eo pipefail {0}
+
 jobs:
   validate:
     name: Validate Sigma Rules
@@ -285,6 +290,7 @@ jobs:
             pySigma-backend-splunk \
             pySigma-backend-microsoft365defender \
             pySigma-backend-elasticsearch
+          mkdir -p compiled/splunk compiled/sentinel compiled/elastic
 
       - name: Compile to Splunk
         run: |