APPLYING TEST-DRIVEN DEVELOPMENT TO DETECTION ENGINEERING

Summary from the TLDR InfoSec newsletter

Test-Driven Development is a software engineering philosophy that often uses an Arrange-Act-Assert design pattern where a state is set up, an action is taken, and then it is determined whether the results were what was expected. In detection engineering, the Arrange step can be modeled by deploying detection logic and setting up a test system. The Act step would then involve executing a test/tool/malware sample. The Assert step would evaluate what response was taken. Depending on the maturity and precision of the alert, the Assert step may make sure that the logs which observe the action are collected, a detection is fired off, or preventative action is taken.