Detection rules need regression tests
Rules break quietly. A test that proves a rule still fires on a known example is the only thing that catches it.
A field gets renamed upstream, a parser changes, a vendor alters a log format, and a detection that worked yesterday matches nothing today while continuing to look perfectly healthy. Without tests you find out during an incident. With them you find out the morning after the format changed.
More on Detection engineering
- A detection is a hypothesis encoded as logicA guess you can run
- High fidelity and high coverage pull in different directionsOne screen, one setting
- Detections inherit telemetry blind spotsThe hole is copied too
- Detection names should describe behaviour, not certaintyName the behaviour
- Suppression is a security decisionThe tag on the switch
- Behaviour often outlives static indicatorsThe footprints, not the coat