
4/30/2026 · Evan Baltman
What this post added
Introduced the WATCH (Weekly Attack Testing for Continuous Health) framework for automated detection testing. WATCH simulates malicious behavior in a staging environment to validate end-to-end detection firing from log source to SOAR alert routing. It leverages GitLab CI/CD for scheduling, test execution, and verification, and integrates with GitLab Duo for AI-assisted test creation by providing a `BaseSecurityTest` abstract class and Duo Agent Skills for defining test creation standards.