Setting up CI/CD runners
Creating the repository allows us to store our code and detections. We will now set up the logic and scripts that will implement our use cases. In traditional code development there might be an all-in-one build-and-deploy pipeline, or a separate pipeline for each. In detection engineering, we are primarily focused on scalable deployments. Let’s start with understanding how to integrate our CI with our target security tooling.
We’ll begin selecting existing SDKs in a supported scripting language in both the target deployment tool and the CI pipeline. Most modern CI solutions support a variety of popular languages. Security tooling API client wrapper support may vary, but it’s common to see Python, PowerShell, and GoLang. In the upcoming labs, we’ll build what is necessary for the CI runner in stages as we work towards an operational deployment pipeline. Let’s begin to apply this concept in Lab 3.2.
Detection engineering...
