Validating syntax and linting

Up until this chapter, we have been focused on the development of our detection use cases and then deployment. As your team is likely to grow, we also need scalable and consistent ways to further enforce best practices, and, in some cases, security requirements. In traditional code development, unit testing uses helper scripts to test functions with sample data and get a rational output. In detection engineering, this differs from true functional testing, requiring a more integrated approach depending on the security tool type. For example, a SIEM or CNAPP requires logs and is unlikely to have a quick installation that can be sampled in an ephemeral CI runner.

Using some types of detections for full testing increases the cost of ownership, where you are either being billed more compute time with GitHub-hosted runners or you are self-hosting and self-administrating infrastructure. I have found that unit-level tests are optimal for security technologies...