Automating cybersecurity threat detections with GitLab CI/CD

What this post added

This post details the implementation of a Detections as Code (DaC) pipeline using GitLab CI/CD to automate the creation, testing, and deployment of SIEM threat detections. Key contributions include: defining a JSON format for detections, establishing a merge request workflow for changes, implementing automated CI/CD jobs for validation (query format, JSON fields, SIEM API checks), enforcing peer review via merge request approval rules, and automating the final deployment to the SIEM and updating MITRE ATT&CK mapping. A sample `gitlab-ci.yml` and a Mermaid diagram illustrate the workflow.