Conceptualizing detection as code requirements

Now that we have established the life cycle of a use case from a detection engineering perspective, technical systems are needed to implement this to scale. As mentioned, CI/CD pipelines are part of it, but the core components will almost always require the following technical considerations:

• Version control systems (with CI runners)
• API support
• Use case syntax
• Testing instrumentation
• Secrets management

Let’s discuss each component in detail.

Version control systems

Modern version control systems will have similar features among major brands and products. Your organization’s developer team may elect to use different systems for their own workflow preferences or compatible integrations with other secrets management systems, third-party risk, and cost considerations. When practical, consider aligning the detection-as-code program to approved and supported security patterns of the enterprise...