Copy into a lab note. An empty field means the rule is not ready.
ID / name:
Log source: (channel, decoder)
Condition: (what must be true)
Positive test: (how to generate the event in the lab)
Negative / FP test: (what can fire this legally)
Analyst fields: (what they must see)
ATT&CK: (only if the log actually covers the technique)
Owner:
Status: draft / tested / noisy / disabled
A rule with no positive test stays draft. An alert from it is still not an incident.