Detection as Code: The Engineering-Focused Future...
summary
Teams move detections into version control with CI/CD to get detection as code and run adversary-as-code tests so a new rule is validated against simulated attacks instead of hoping it fires. Infrastructure as code and Terraform recover blown away IAM. Open source substation serverless pipelines control log ingestion and enrichment, enabling a log-priority backlog (high/med/low) for a three-person team and cutting noisy spikes from thousands of alerts to single deduplicated incidents. Smaller in‑house LLMs summarize incident chat and automate repetitive triage.
AI-written summary · about
chapters (12)
- 0:00Introduction to detection as code
- 3:38Panelist introductions
- 6:35Benefits of detection as code
- 9:34Infrastructure as code
- 12:02Data engineering for security
- 14:34Build versus buy mentality
- 17:43Prioritization and frameworks
- 22:51Documentation and collaboration
- 25:53Automation and ownership
- 29:30Reducing alert fatigue
- 32:48Future trends and AI
- 37:26Audience Q&A
related talks
30mDetection as Code: Detection Development Using CI/CD
30mDetection Allegro: Composing Detection Rules with... (Raphael Ruban, Chen Cao)
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
01h 02mSecuring data and democratizing the alert landscape
30mBuilding Effective Attack Detection in the Cloud
04mPreventative+Detective Control for Security
44mCloud Security Podcast - LIVE!