Detection content as code: reviewing a change the way you review software
Detection content as code: reviewing a change the way you review software The problem with editing rules in a console Detection rules written directly in a security platform have no review, no history, and no test. A change to a rule that suppresses a noisy alert is made because an analyst was paged at night, and the effect on coverage is discovered months later when the technique it caught…
Detecting threats in security systems often involves writing detection rules directly in a platform's console. However, this approach lacks essential features such as review, version history, and testing. When a rule change is made to reduce the number of false positives, it may go unnoticed for months until an incident reveals the problem. The solution lies in treating detection content as code, which introduces review, version control, and automated testing processes.
A recommended workflow includes storing detection rules in a plain text format within a repository. The platform should load the rules from this repository instead of the other way around. Sigma rules provide a portable intermediate representation that works across different security platforms. The first step in the review process is to verify that the rule accurately detects the intended threat described in its documentation and that it doesn't inadvertently start suppressing other meaningful threats.
Automated validation should be performed before merging any changes. This includes syntax checks to ensure the rule is properly formatted, as well as additional validation to confirm the rule behaves as intended. To comprehensively test a rule, it should be run against a dataset of recorded events. This helps verify that the rule correctly identifies known malicious samples while remaining silent on normal network traffic.
One common issue that leads to coverage erosion is the use of suppression mechanisms. Suppressions should be documented with specific information about the alert being suppressed, the source or account affected, the reason for the suppression, and an expiry date. By maintaining a suppression file with an expiry column, stale entries become visible, preventing unnoticed gaps in coverage.
When a rule is disabled entirely, it's crucial to record the covered threat technique and the decision-maker who accepted the resulting decrease in protection. This documentation helps turn an undocumented security gap into an intentional risk acceptance.
Thorough testing of detection rules is essential. The most effective method involves replaying actual recorded telemetry against the rule set and comparing the alerts generated before and after any changes. This approach can uncover problems like a renamed log field causing a rule to stop firing, which syntax validation alone cannot detect.
Additionally, maintaining a small set of known-bad samples with expected results allows for verifying that rules should be firing are functioning correctly. Rules that have never triggered in production should be considered untested, and their validation status should be monitored. Regularly tracking metrics such as rule count, technique coverage, and the number of active suppressions over time helps identify when detection capabilities are declining as the threat landscape evolves.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
