MSSP implements Detection as Code across four SIEMs

An engineer at a multi-platform Managed Security Service Provider details how they implemented Detection as Code to manage and scale security rules across multiple environments and SIEM platforms. The author describes organizing detection content into modular JSON content packs deployed through CI/CD pipelines, utilizing AI agents for cross-platform query translation, and building a frontend user interface for analysts. Open article →