Detection as code
Managing detection rules like software: version control, peer review, automated tests and CI/CD deployment to the SIEM.
With detection as code, rules live in git (often as Sigma or the SIEM's native language) with metadata: owner, ATT&CK mapping, severity, expected false positives, response runbook. Pull requests get review, CI validates syntax and runs each rule against recorded true-positive and benign samples, and a pipeline deploys to the SIEM.
It exists because console-edited rules drift, break silently when log formats change, and have no history explaining why a filter was added. Code workflows bring rollback, coverage reporting and accountability.
Pitfalls: tests that only check syntax, not that the rule fires on real attack data, and exceptions added in the console that bypass the repo. Continuous validation with attack simulation (Atomic Red Team style) closes the loop.