Performing metadata and taxonomy checks

Now that we have a general sense of what good unit-level tests are, we can add another layer of logic. As we measure any detection engineering program, tracking what is deployed in production based on which framework we’re aligned to helps with determining our coverage. For example, in the MITRE ATT&CK framework, tracking is based on categories of TTP identifiers. Every team is different so you may have additional frameworks. Ideally, your use cases should have these in tags or descriptions, which can be easily parsed for reporting.

In addition to the taxonomy presence checks, we can also use dynamic checks for applicability for our use case. For example, if we reference a particular TTP identifier, a URL, or some other threat intelligence, we can match this against the payload dynamically by referencing what we have detailed in the meta with an external source. Keep in mind that this doesn’t prevent us from writing detections...