WHY IS NO ONE TALKING ABOUT MAINTENANCE IN DETECTION ENGINEERING?

Summary from the TLDR InfoSec newsletter

With the movement of detection engineering towards a detection-as-code model, detection engineers must also embrace software maintenance requirements. Maintenance can be broken down into four categories: corrective maintenance, which directly fixes an issue that is occurring; adaptive maintenance, which adapts the detection to changing requirements such as a new API; perfective maintenance, which focuses on improving the query, documentation, or adding new features; and preventative maintenance, which proactively seeks to address issues before clients identify them. Although all detection engineering teams must perform maintenance, there is a dearth of information and posts discussing it.