DETECTION AS CODE: A MATURITY FRAMEWORK

Summary from the TLDR InfoSec newsletter

This post breaks Detection as Code (DaC) into four components: language, testing, integration, and monitoring. When a team starts adopting DaC, they may use markup languages before moving on to query languages and finally general purpose programming languages. As teams adopt testing for their DaC, they will likely begin with unit testing before adopting other forms of testing like integration testing and end-to-end testing. Teams will also add more monitoring and integrations as they mature. A maturity matrix is included at the end of the post.