Developing Core CI/CD Pipeline Functions
We’ve arrived at one of the most important components of automating the detection lifecycle: pipelining. Previously, we familiarized ourselves with threat prioritization and automating IOCs for security tool consumption. IOCs should supplement use cases but aren’t enough to fulfill use cases on their own without additional logic. We need infrastructure to collaborate with other team members and securely have a way of controlling use case versioning and deployment.
This chapter focuses on creating and implementing a version control system and a direct pipeline to facilitate deployment into multiple solutions including EDRs, SIEMs, and Cloud Native Application Protection Platforms (CNAPPs). We will work through hands-on labs that set up a repeatable integration pattern using well-known and industry-supported technologies in a secure manner.
By the end of the chapter, you will be able to create multiple CI/CD pipelines that...
