Workshop from DEATHcon (deathcon.io) 2024 "Detection Testing with CI/CD and AI" by Dennis Chow
Enterprises are starting to leverage more Detection-as-Code programs to scale their detection engineering efforts. These programs help scale deployments, but many organizations aren't using their CI/CD's to the fullest extent. To further "shift left", we need to also scale and automate validating our use cases.
In this workshop, you will learn how to create unit and integration tests using GitHub style runners for different use cases including: HIDS (OSSEC), NIDS (Suricata style), Synthetic testing of SIEM correlations (Splunk SPL) using GenAI (Poe.com), and integration testing in the AWS cloud
Technical Requirements:
Unit Testing: GitHub Personal or Teams Account (Free Actions minutes for public repo usage. Or have at least ~10-20 minutes left in the month for private repo usage)
Integration Testing: AWS account with admin access within the us-east-1 region
Synthetic AI Testing: Poe.com Subscription for API access ($20 /month) or Trial
Optional Color Coding Reading: VSCode or any other IDE of choice