Guest:

Topic:

Detection as code is one of those meme phrases I hear a lot, but I’m not sure everyone means the same thing when they say it. Could you tell us what you mean by it, and what upside it has for organizations in your model of it?
What gets better for security teams and security outcomes when you start managing in a DAC world? What is primary, actual code or using SWE-style process for detection work?
Not every SIEM has a good set of APIs for this, right? What’s a team to do in a world of no or low API support for this model?
If we’re talking about as-code models, one of the important parts of regular software development is testing. How should teams think about testing their detection corpus? Where do we even start? Smoke tests? Unit tests?
You talk about a rule schema–you might also think of it in code terms as a standard interface on the detection objects–how should organizations think about standardizing this, and why should they?
If we’re into a world of detection rules as code and detections as code, can we also think about alert handling via code? This is like SOAR but with more of a software engineering approach, right?
One more thing that stood out to me in your presentation was the call for sharing detection content. Is this between vendors, vendors and end users?

Resources:

Ask the Expert: Preventing injuries in your active dog, warm ups and cool downs (Episode 13)