- 01Detection content has the operational impact of application code and the failure modes of application code. Treating it like application code is the discipline that produces durable detection programs.
- 02What 'as code' means: version control as source of truth (not the SIEM UI), code review for every detection before it ships, unit tests with positive and negative cases for every rule, CI for syntax/schema/false-positive checks, gradual canary deployment (not big-bang), decommissioning workflow with a record.
- 03Format choice: Sigma (and Sigma 2.0) is portable across SIEMs; vendor-native formats are richer but lock you in. Author in Sigma where the analytic is portable and use vendor-native where it relies on platform-specific capabilities — both checked into the same repository.
- 04What this changes: detection becomes durable, new analysts can read why a rule exists, audit becomes a query (not a project), and the MTTR for detection content (rule was wrong; how fast can we fix it?) collapses from weeks to hours.
Detection content — the rules, queries, and analytics that drive your SOC — has the operational impact of application code and the failure modes of application code. Treating it like application code is the discipline that produces durable detection programs.
What 'as code' means in practice
- 01Version control as the source of truth (not the SIEM UI)
- 02Code review — every detection has a peer review before it ships
- 03Unit tests — positive and negative cases for every rule
- 04Continuous integration — syntax, schema, and false-positive checks
- 05Continuous deployment — gradual rollout via canary, not big-bang
- 06Decommissioning workflow — rules that retire have a record
Format choice
Sigma (and Sigma 2.0) is portable across SIEMs. Vendor-native formats are richer but lock you in. The pragmatic choice is to author in Sigma where the analytic is portable and use vendor-native where the analytic uses platform-specific capabilities — both checked into the same repository.
What this changes
Detection becomes durable. New analysts can read the history of why a rule exists. Audit becomes a query, not a project. The MTTR for detection content (the rule was wrong; how fast can we fix it?) collapses from weeks to hours.