Phase 6 – Deploy

The goal of this phase is to take the developed detection from the test environment and migrate it to the production environment. This detection is also monitored to ensure it runs as expected and does not negatively impact the performance of the production system. The following are the inputs and outputs associated with this phase:

• Input: Tested detection code
• Output: Deployed detection code

Deployment tags are a useful method for representing the maturity stages of a detection, enabling the rapid release of new capabilities while limiting the impact of a malfunctioning detection on analysts reviewing alerts. Here are the criteria for the experimental, test, and stable maturity stages:

• Experimental: At this stage, the detection has been designed and converted into code but extensive testing on its performance in a real environment has not been tested. Tweaking will likely need to be done for it to be ready before a peer review. The...