Detection as Code: Detection Development Using CI/CD
summary
Claims a CI/CD pipeline can turn detection rules into repeatable, testable software: use Sigma or Splunk Security Content YAML, convert and package into Splunk apps via CircleCI/GitHub, validate with linting and app-inspect, then spin an Attack Range or Mordor labs instance (build ~30 minutes with Terraform/Ansible or Vagrant), run Atomic Red Team or Caldera simulations like T1003 credential dumping, and report pass/fail so deployments are automated and verifiable.
AI-written summary · about
chapters (12)
- 0:00Intro
- 3:07CI/CD Workflow - Detection Engineering
- 4:04Commit detection - detection schema
- 6:33Commit detection - Branching workflow
- 7:58Convert Detection & Package Detection
- 14:23Test Detections
- 17:40Mordor Labs
- 21:29Attack Range Architecture
- 22:28Attack Range Commands
- 24:57Notify of test outcome
- 27:04Deploy detections
- 28:45Apply What You Have Learned Today
related talks
47mDetection as Code: The Engineering-Focused Future...
34mA Blueprint for Detection Engineering: Tools, Processes, and Metrics
49mThe Always-On Purple Team: An Automated CI/CD for Detection Engineering
30mDetection Allegro: Composing Detection Rules with... (Raphael Ruban, Chen Cao)
24mSecurity as Code A SecDevOps Use Case
37mA Secure Continuous Delivery Pipeline
42mContinuous Security: Integrate security tools into your DevOps Pipeline
39mSecurity Tooling in Your DevOps Pipeline