Executing Live-Fire Asynchronous Tests

As we progress through the chapter, we have been able to create very useful and realistic opportunistic testing based on our payloads. With in-line testing, we ensure that no rule gets deployed to production or gets rolled back if a test fails. However, we also saw in the prior labs that there is significantly more components to configure and maintain. A potential alternative is to have closely emulated testing combined with an asynchronous workstream. Thinking back to integration testing purposes in the context of detection engineering; we are looking for edge cases where external environment or different conditions may cause a detection to fail outside of the unit level testing.

By the same rationale, more complex systems and conditions to discover problems with the detection also give more opportunities to fail on abnormal conditions. For example, let’s say your self-hosted runner was patched or upgraded packages where some of your...