Detection Engineering Dispatch Maturing SecOps with Detection-as-Code
Nov 27, 2024
Wade Wells, detection engineer and founder of WadingThruSecurity, brings practical Detection-as-Code experience. He explains treating detections like software, using version control and CI/CD. Conversations cover testing challenges, documentation strategies, cross-team alignment, centralizing repos, mapping to MITRE, and practical tips for adoption and automation.
AI Snips
Chapters
Transcript
Episode notes
Treat Detections Like Software
- Detection-as-code is essentially applying a software development lifecycle and CI/CD pipeline to detections to gain version control and change management.
- Wade describes storing detections centrally and using automation to push changes to each security tool, fixing tools' weak change control.
Test Detections Manually Before Automating
- Add testing where practical but recognise tests can equal or exceed detection effort and may require log replays or privileged actions.
- Wade runs attacks manually first to capture logs then builds detections, avoiding risky automated attack tests for some cases.
Start Small And Gate Automated Changes
- Implement minimal automation first and require mature approvers to avoid dangerous fully-automated changes.
- Wade recommends starting with create/modify/disable flows and delaying heavy automated testing until you have resources and access.