Automating Security Detection Engineering by Dennis Chow

Author:Dennis Chow
Language: eng
Format: epub, pdf
Publisher: Packt Publishing Pvt Ltd
Published: 2024-05-23T00:00:00+00:00

Validating syntax and linting

Up until this chapter, we have been focused on the development of our detection use cases and then deployment. As your team is likely to grow, we also need scalable and consistent ways to further enforce best practices, and, in some cases, security requirements. In traditional code development, unit testing uses helper scripts to test functions with sample data and get a rational output. In detection engineering, this differs from true functional testing, requiring a more integrated approach depending on the security tool type. For example, a SIEM or CNAPP requires logs and is unlikely to have a quick installation that can be sampled in an ephemeral CI runner.

Using some types of detections for full testing increases the cost of ownership, where you are either being billed more compute time with GitHub-hosted runners or you are self-hosting and self-administrating infrastructure. I have found that unit-level tests are optimal for security technologies, as they have a local binary that can emulate input with minimal or static configuration needs. Unit logic tests and syntax validation are easier to write for security solutions that don’t correlate or need too much parsing and external system interpretation. We suggest that newer detection engineering teams should start with EDR and NDR solutions.

Although EDR and NDR detections may seem limited for unit-level validation compared to log and posture checking solutions, they are more practical for local validation with minimal computation, which are more economical to test compared to high-traffic and configuration-dependent tests.

When scoping unit-level logic, we can start with basic syntax validation. There are pre-built linting tools for common language formats known to the development community, such as the following:

Language

Linter Name

Link

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.