Unveiling the GUARD framework to automate security detections at GitLab

Introduces the GUARD framework (GitLab Universal Automated Detection and Response) for automating security detections, maintenance, alert routing, metrics collection, and incident escalation. Highlights GUARD's design principles: standardization, reduction of alert fatigue, metrics generation, and GitLab-centricity. Details GUARD components: Detection as Code (DaC), User Attestation Module (UAM), Enrichments, Alert Triage and Response, and Metrics Generation. Explains how GitLab features (projects, MRs, issues, labels, CI/CD) are used within GUARD. Discusses metrics generation for Time to Respond, Time to Resolve, and alert fidelity.