Open Source GitOps for Detection Engineering

Detection engineering is often done by hand through consoles and alert triage, which makes changes hard to track and review. The talk argues for treating detections like software: keep rules in text files under version control and push them through pull requests. It frames this as detection as code, borrowing the configuration-as-code idea from DevOps.

The talk assembles an open source stack. osquery exposes system data across Mac, Linux and Windows as SQL tables. Fleet deploys osquery at scale, schedules its queries from YAML, and ships results to S3. Matano, a serverless security data lake on AWS, ingests those logs and runs Python detections that carry metadata such as runbooks, false positive notes and ATT&CK mapping. A live demo adds a query that flags SSH daemons listening on a non-standard port. A reviewer approves the pull request, and a CI job applies the Fleet and Matano configuration in under a minute.

Practical takeaways include requiring approvals so changes get a second look and leave an audit trail, and restricting UI edits or running scheduled syncs to limit configuration drift. Testing and validation should accompany each detection, and repetitive response steps are worth automating. The Q&A covered where to find starter queries and how osquery's watchdog stops runaway queries from hurting endpoint performance.