Unveiling the GUARD framework to automate security detections at GitLab

What this post added

This post introduces the GitLab Universal Automated Detection and Response (GUARD) framework, a collaboration between the Security Incident Response Team (SIRT) and the Signals Engineering Team. GUARD standardizes the detection and alerting pipeline, aims to reduce alert fatigue through consolidation and risk scoring, collects metrics for response efficiency, and uses GitLab as a single source of truth for detection definitions. Key components include Detection as Code (DaC) deployed via GitLab CI/CD, a User Attestation Module, enrichments for alert context, standard alert triage and response, and metrics generation. GitLab projects store detection rules in JSON, MRs are used for changes with approval rules, issues track engineering efforts, labels standardize documentation, and CI/CD automates deployment to the SIEM.