Detection-as-code pipeline
Built a Sigma pipeline that validates detection rules and compiles them to KQL for Sentinel and Defender on every commit.
Four detections mapped to MITRE ATT&CK: password spray (T1110.003), brute force (T1110.001), malicious inbox rule creation (T1098), and impossible travel.
The problem
Detection logic written as one-off SIEM queries is unreviewable and quietly rots. It needed to live in version control with the same gates as application code.
What I built and owned
Rules are validated and compiled on every commit. Each detection includes false-positive analysis and validation steps.
Review. Validate. Compile.
Sigma rules live in Git. GitHub Actions validates their syntax and compiles them into KQL for Microsoft Sentinel and Defender on every commit. Each rule includes false-positive analysis and validation steps.
A focused detection catalogue
Four detections mapped to MITRE ATT&CK: password spray (T1110.003), brute force (T1110.001), malicious inbox rule creation (T1098), and impossible travel.