How to Improve and Accelerate Detection Rule Development using CI/CD
Channel: FIRST
Date: 2021-02-12

Well developed detection rules provide strong signals into anomalous and potentially malicious activity. Poorly developed detection rules flood the analysts with low-level alerts and are the cause of alert fatigue. This talk will introduce detection rule development using Continuous Integration and Continuous Delivery (CI/CD) to improve the quality of rules created and accelerates the rule development process.

The later you find a bug in your detections, the more expensive it is to solve it! Therefore, the presenter will introduce CI pipelines using CircleCI in order to proactively find bugs on detection rules, before they are deployed in production. In order to successfully test the effectiveness of your detection you need a lab and an attack simulation engine. The attack range combines both a lab and attack simulation into an easy to use tool. The presenters will introduce the attack range tool and show how you can integrate it into your CI/CD pipeline to automatically test your detections.

Lastly, the presenters will share how CD can automatically deliver the detection rules to the SIEM via either a package or over an API.
--
José is a Principal Security Researcher at Splunk. He started his professional career at Prolexic Technologies (now Akamai), fighting DDOS attacks from “anonymous” and “lulzsec” against Fortune 100 companies. As a engineering co-founder of Zenedge Inc. (acquired by Oracle Inc.), José helped build technologies to fight bots and web-application attacks. While working at Splunk as a Security Architect, he built and released an auto-mitigation framework that has been used to automatically fight attacks in large organizations. He has also built security operation centers and run a public threat-intelligence service. Although security information has been the focus of his career, José has found that his true passion is in solving problems and creating solutions. As an example, he built an underwater remote-control vehicle called the SensorSub, which was used to test and measure toxicity in Miami's waterways.

Patrick Bareiss, Senior Security Researcher at Splunk, is a passionate security researcher in the field of detection engineering. He combines his knowledge of IT security with his coding skills to develop powerful open source tools, such as Attack Range. Before Splunk, Bareiss developed the detection framework for the SOC of Airbus Defence and Space. He is a frequent speaker at security conferences.