A FIVE YEAR RETROSPECTIVE ON DETECTION AS CODE

Summary from the TLDR InfoSec newsletter

This author discusses Detection as Code and lessons learned in five years as it has evolved beyond simply writing detection logic in programming languages to focus instead on codifying processes and leveraging CI/CD pipelines for automated checks and version control. Test-Driven Detection (TDD), which emphasizes test creation before writing detection logic, is emerging as a best practice. LLMs show promise in auditing and improving detector descriptions within CI/CD pipelines but aren't suitable for creating detection logic.