Detection as Code

What Detection as Code teaches: write detections in Sigma, test them against committed fixtures, gate them on CI, and deploy them to any SIEM through a pipeline you own. The discipline, the toolchain, the repository you build, and how the course is structured. Start here.

Author Sigma detection rules from scratch: the rule anatomy, the logsource taxonomy that targets the right events, the field maps and lists that express matching, the modifier system, the condition language, and correlation rules. By the end you write and validate a rule with sigma-cli.

Turn a pile of rule files into a detection library: a repository layout that encodes tactic, the rule-test-documentation contract, a metadata standard enforced repo-wide, and naming and identity that hold at scale. The structure the rest of the pipeline reasons about.

Manage detection content as code: a branching model that keeps main always deployable, commit hygiene that makes the history an audit trail, the pull request as the review surface for a detection, why detection review is its own discipline, and CODEOWNERS routing approvals by tactic.

Turn portable Sigma source into the query your SIEM actually runs. The sigma-cli and pySigma toolchain, converting one rule to KQL, SPL, and Elastic, processing pipelines that map fields and tables, pipelines as version-controlled code, and where conversion breaks.

A rule that converts cleanly can still be dead on arrival. Fixture-based testing: true-positive and benign-baseline events, a hand-built test harness, Atomic Red Team as a fixture source, and fixtures committed with the rule they prove.

A suite that only runs when someone remembers to run it protects nothing. GitHub Actions: lint, convert, test, and block a bad rule from merging, built as the actual workflow YAML rather than described in the abstract.

A merged rule that a person still pastes into a portal is not deployed. This module builds the stage that carries a rule from the repository into a live SIEM, the credential that stage needs, and the rollback that makes automating it survivable.

A coverage map maintained by hand is out of date the moment a rule merges. This module generates the coverage layer from the rules themselves: an inventory from rule metadata, an ATT&CK Navigator layer as a build artifact, gap analysis from the inventory, and the loop from a gap to the next rule request.

A false positive is a signal, not a failure. Tuning a rule through the same pull request flow as any change, suppression and allowlists as versioned code, and the honest limit of Sigma: the expressiveness ceiling and the native-detection escape hatch, where a rule legitimately lives as KQL or SPL.

A rule set nobody measures rots silently. Rule health pulled from the repo and the SIEM, coverage drift over time, the maturity gradient that tells you how much pipeline your org actually needs, and the RACI and cross-team flow that make a detection program run.

The whole lifecycle in one assessment. A new threat lands with no coverage, and you carry it through every stage you built: Sigma rule, fixtures, tests, pull request, CI, deployment, coverage layer, and rule-health entry. One detection, shipped end to end.

The Sigma syntax, the Git operations, the pipeline stages and the failure modes, one sheet per part of the system.

Ordered procedures for building the pipeline, each stopping where the value stops rather than where the method ends.

A working repository, pipeline and deployment path built from nothing, with every silent failure produced deliberately.

Detection engineering reasoned end to end, including the cases where the pipeline was green and the answer was still no.

What to do when the pipeline fails, a rule turns out dead, drift appears, or somebody asks for a rule you cannot write.

Every practice surface available for this course, what each one gives you, and where the gaps are.

Sigma, pySigma, ATT&CK, Atomic Red Team, DeTT&CT, and the backend and CI documentation used throughout the Detection as Code course, organized by category.

Detection as Code end-of-course exam: a scenario-based assessment testing whether you can carry a new detection through the full pipeline, from a threat you have not seen to a deployed, measured rule, using the method built across all twelve modules.