Phase 5 – Test

Testing is a way to validate the efficacy of your detection and reduce its noisiness before deploying it within a production environment. While we show testing as occurring after development, in reality, it is a continuous process that occurs throughout the detection development process. It should not be relegated to occurring only after development is complete. A best practice within DE is to use testing to guide the development process.

Test-driven development is a software development technique that adapts well to this purpose. Tests are designed before development and are first added to the automated acceptance testing infrastructure. The development process starts with running the tests against your existing detection capabilities. This may result in you identifying already existing detection capabilities or confirming the failure of these tests, which identifies the need to create or update a detection. During the development process, these tests are...