3. Patrick Bareiß - The return of detection engineering: detection development using CI/CD

The later you find a bug in your detections, the more expensive it is to solve it! Therefore, the presenters will introduce CI pipelines in order to proactively find bugs in detection rules, before they are deployed in production. The CI pipelines leverage a combination of lab and attack simulation.

Well developed detection rules provide strong signals into anomalous and potentially malicious activity. Poorly developed detection rules flood the analysts with low-level alerts and are the cause of alert fatigue. This talk will introduce a modern approach of detection engineering using Continuous Integration and Continuous Delivery (CI/CD). The later you find a bug in your detections, the more expensive it is to solve it! Therefore, the presenter will introduce CI pipelines in order to proactively find bugs in detection rules, before they are deployed in production. In order to successfully test the effectiveness of your detection, you need a lab and an attack simulation engine. The attack range combines both a lab and attack simulation into an easy to use tool. The presenter will introduce the attack range tool and show how you can integrate it into your CI/CD pipeline to automatically test your detections. Lastly, the presenter will share how CD can automatically deliver the detection rules to the SIEM via either a package or over an API.