Lion Cipher Lab
Build a detection-as-code pipeline: unit-test your Sigma rules and gate them in CI
- SOC Analyst / Blue Team
- Advanced
- ~75 min
- Free · no account required
Why it matters
Most detection content dies the same quiet death: someone writes a rule, pastes it into the SIEM, it looks reasonable, and then nobody ever proves it fires on the thing it is supposed to catch or STAYS QUIET on the everyday noise it is supposed to ignore. Six months later the log field got renamed, the rule matches nothing, and no alarm went off because 'no alerts' looks exactly like 'no attacks.' Detection-as-code is the fix the best SOCs adopted from software engineering: your detections live in a git repository, every change is reviewed, and a continuous-integration (CI) pipeline…
What you'll learn
- detection-as-code workflow (version control + review + CI)
- validating Sigma rules with sigma-cli (sigma check / sigma convert)
- writing fire-on-bad / quiet-on-good unit tests for detections
- a false-positive gate that fails the build
- a GitHub Actions regression gate for detection content
Steps in this lab
- The idea: detections are code, so treat them like code
- Set up the workspace and install the tooling
- Write a real detection rule (and pin it in git)
- Machine check 1 — lint the rule with 'sigma check'
- Machine check 2 — convert the rule with 'sigma convert'
- The step everyone skips — fire-on-bad / quiet-on-good UNIT TESTS
- Prove the gate bites — break the rule two ways
- Wire it into CI — a GitHub Actions regression gate
- The judgment: what a green pipeline does and does NOT buy you
- What you built — and the reflex to keep