Detection-as-Code: Test Driven Detection Development

1. Detection-as-Code:
Test Driven Detection
Development
Mauricio Velazco
@mvelazco

2. #whoami
✘ Threat Research @ Splunk
✘ @mvelazco
✘ Bsides, Derbycon, Defcon, BlackHat
✘ github.com/mvelazc0

3. 1.
Introduction

4. Threat Detection

5. Challenges in Detection
https://www.cardinalops.com/siem-industry-research-report

6. Detection Engineering
Continuous process of building,
deploying, tuning and operating
detection analytics while applying
engineering concepts.

7. 2.
Detection Engineering

8. Learning From DevOps

9. Learning From DevOps

10. Test Detections
Jose Hernandez and Patrick Bareiss, RSA 2020

11. Detection
Language
Version Control
System
Automated
Workflows
Test-Driven-
Development
Detection as Code Principles
Jose Hernandez and Patrick Bareiss, RSA 2020

12. Test Driven Development
… software development process
relying on software requirements
being converted to test cases
before software is fully developed…
https://www.kaizenko.com/what-is-test-driven-development-tdd/

13. Testing Detections
Jose Hernandez and Patrick Bareiss, RSA 2020

14. Takeaways
Applying engineering practices to
detection programs can improve
your security posture.
To shift to test driven development,
teams need the capability to
replicate attacks.

15. Detection-as-Code:
Test Driven Detection
Development
Mauricio Velazco
@mvelazco