← detection engineer
Take Quiz →
Detection-as-Code — Git, CI, Tests, Deployment
intermediate 4h
Structure a detection repository with PR-based authoring, automated linting, unit tests, and CI deployment pipelines.
After this module you will
- › Explain why version control is foundational to detection engineering
- › Design a detection repo layout with rules/, tests/, and environment configs
- › Write unit, integration, and regression tests for a detection rule
- › Build a GitHub Actions pipeline that lints, tests, converts, and deploys rules
- › Evaluate the Elastic detection-rules and panther-analysis repo patterns
Lessons
1 Why Detection-as-Code — From Ad-Hoc to Engineering Discipline
20 min 2 Detection Repository Layout — Structure That Scales
25 min 3 Testing Detection Rules — Unit, Integration, and Regression
30 min 4 CI/CD for Detection Rules — Automate Lint, Test, Convert, Deploy
25 min 5 Real-World Detection Repos — Patterns from Elastic, Panther, Splunk, and SigmaHQ
25 min Module Quiz
Test your knowledge before moving on.