Log Management and Observability
Automate detection testing with GitLab CI/CD and Duo

Automate detection testing with GitLab CI/CD and Duo

4/30/2026 · Evan Baltman

What this post added

Introduced the WATCH (Weekly Attack Testing for Continuous Health) framework for automated detection testing. WATCH simulates malicious behavior in a staging environment to validate end-to-end detection firing from log source to SOAR alert routing. It leverages GitLab CI/CD for scheduling, test execution, and verification, and integrates with GitLab Duo for AI-assisted test creation by providing a `BaseSecurityTest` abstract class and Duo Agent Skills for defining test creation standards.

Read the original post ↗