⚡AgentSkills
🔐 Cybersecurity · Detection Operations

Test detections like code with unit + integration suites

Atomic test fixtures, expected-fire assertions, and regression packs keeping detection debt visible.

advanced~45 minSecurity EngineersAppSecDevSecOps

Steps

  1. 1Every rule ships with fixture events that MUST fire + MUST-NOT-fire neighbors
  2. 2Run rule suites against synthetic telemetry in CI on every change
  3. 3Track rule precision/recall over time like code coverage trends
  4. 4Version rules semantically; logic changes bump minor, tuning patches
  5. 5Quarantine flaky environment-dependent rules visibly, fix root cause
  6. 6Report suite health to leadership: rules tested %, drift count

Common Pitfalls

  • ▲Rules edited live in SIEM UIs diverging from repo truth
  • ▲Fixtures rotting until they validate nothing anymore

Commands

Install with skills CLI
$ npx skills add aniruddhaadak80/skills --skill detection-operations-detcode-testing
Install globally
$ npx skills add aniruddhaadak80/skills --skill detection-operations-detcode-testing -g

Tags

#detection-as-code#testing#ci#cybersecurity#detection-operations

Related skills

Operationalize threat intel instead of hoarding itadvanced

Relevance filtering, indicator decay, and hunt/detection integration converting feeds into actions.

🔐 Cybersecurity·~40m
Open →