Automate detection testing with GitLab CI/CD and Duo

This post introduces the WATCH (Weekly Attack Testing for Continuous Health) framework, an automated system for testing security detections. WATCH simulates malicious behavior in GitLab's staging environment to validate that detections fire end-to-end through the SIEM and SOAR. It leverages GitLab CI/CD for scheduling, execution, and verification. The framework is designed for ease of use, allowing engineers to write new tests by subclassing `BaseSecurityTest` and focusing on setup, execution, and cleanup. GitLab Duo is highlighted as a tool to accelerate test creation by scaffolding WATCH tests based on prompts and Duo Agent Skills.