Detection Allegro: Composing Detection Rules with... (Raphael Ruban, Chen Cao)
summary
Claims an 80% reduction in detection development and maintenance time by wiring a prompt-builder plus a coding agent into the CI: Gather log schemas and samples, consult Notion and MITRE, spawn Linear tickets that trigger a Lambda-backed agent image from ECR which lints, tests, and runs queries against Athena via an Athena SQL skill, supports scheduled vs streaming detections, and runs a weekly bug-fix lambda. Pipeline uses Grove, Substation, StreamAlert, Tracecat; it generates tests, PRs, and has produced 150 new detections so far.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:04Current detection challenges
- 3:11Personal experience with GitHub
- 5:15Demo of AI workflow
- 8:07Why AI is suitable here
- 9:30Detection creation process
- 13:02Maintenance and bug fixes
- 15:53Idea generation workflow
- 18:22Pitfalls and learnings
- 20:28Orchestration benefits
- 22:13Results and impact
- 23:18Q&A session
related talks
47mDetection as Code: The Engineering-Focused Future...
30mDetection as Code: Detection Development Using CI/CD
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
37mHow to Train Your Detection Dragon
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
45mSweeping Up...
01h 02mSecuring data and democratizing the alert landscape
56mContinuous innovation in AWS detection and response services