Using CI/CD Pipelines to update security content in your SIEM
Any data engineers or SIEM experts know one of the hardest components is keeping data normalized to a common schema to ensure all detections are consistent and accurate. Borrowing CI/CD for Security use case deployment is a natural fit to provide provide security detections, also known as correlation searches, to detect malicious or suspicious activity from event logs. KQL is code, code belongs in a repo. It should be tagged and versioned, just like .NET or C or Python. We will walk through: Use Cases - we first start with a Use Case to clearly outline the activity we are attempting to detect. This enumerates all the requirements from required data sources, specific fields, activity tracking, response procedures, and more. This is something usually captured and tracked in JIRA or something similar Security Detection Logic - Microsoft Kusto Query Language (KQL) is developed based on an Information Model to generate the required results to alert a SOC analyst of suspicious activity. This KQL is then checked into a code repository, where it is version controlled and merge requests are tracked. Connectors - Applying this logic here to also to parse the data according to the Information Model and apply required enrichments for the Security Detection Logic has to be thought of together to be successful. Configuration files such as HVA lists, logic apps and watchlists can also checked into the code repository, where they can also be version controlled and merge requests are tracked.
