The Always-On Purple Team: An Automated CI/CD for Detection Engineering
summary
A CI/CD-style detection pipeline is built that wires XSOAR + Caldera + Sentinel with Sigma and an LLM to automatically extract TTPs from threat reports, map them into Caldera abilities, run breach simulations, and propose KQL rules. Vanilla LLM output is brittle but a feedback loop fixes errors and yields more hits (demo shows LLM auto-generates KQL and 29 hits after fix). The system runs end-to-end, speeds rule creation, but keeps humans for fine‑tuning and false‑positive control.
AI-written summary · about
chapters (12)
- 0:00Introductions and overview
- 3:18Defining the security landscape
- 7:21The purple team approach
- 10:12Practical purple teaming
- 14:01Automation and orchestration
- 20:13Credential guard case study
- 23:56Integrating LLMs and automation
- 28:35Automating detection workflows
- 33:40Handling false positives
- 36:59Live automation demo
- 42:28AI agents and future outlook
- 47:26Closing thoughts
related talks
30mDetection as Code: Detection Development Using CI/CD
52mBuilding the Always-On Purple Team
47mDetection as Code: The Engineering-Focused Future...
30mDetection Allegro: Composing Detection Rules with... (Raphael Ruban, Chen Cao)
30mIntelligent Pipelines: Bringing AI/ML into DevSecOps Automation
24mDetect known unknowns
38mNext-Gen Detection: Harnessing LLMs for Sigma Rule Automation
44mCloud Security Podcast - LIVE!