Designing Detection-as-Code: The BluePhoenix Lab Approach

Designing Detection‑as‑Code Without a SIEM

Leonardo Barros created BluePhoenix to demonstrate detection engineering without the abstraction of enterprise SIEM platforms. This lab treats security rules as version-controlled software artifacts that require logic validation and peer review.

Why This Matters

Moving detection engineering away from SIEM platforms forces engineers to focus on behavior and logic rather than vendor-specific dashboards. This approach mitigates the risk of learning a tool instead of a discipline, ensuring that security signals remain portable, auditable, and maintainable across any environment. By treating detections as code, teams can apply standard software engineering rigors—such as CI/CD validation and version control—to security operations, reducing the reliance on artificial noise levels and costly enterprise tooling.

Key Insights

• Detections are treated as version-controlled YAML files containing logic, ATT&CK mapping, and test cases (Barros, 2026).
• CI checks enforce schema validation and structural consistency to ensure the predictability of the response pipeline.
• Focusing on behavior over platform features makes detections more resilient to changes in enterprise tooling.
• Specific technique mapping, such as T1059.001 for PowerShell, prevents the creation of noisy, broad ‘catch-all’ rules.
• BluePhoenix emphasizes engineering discipline, requiring rules to be modular, structured, and validated before merging.

Practical Applications

• BluePhoenix behavior mapping: Aligning every rule to a specific MITRE ATT&CK technique to ensure coverage clarity. Pitfall: Using enterprise SIEMs as a crutch, which creates false realism and hides the logic behind pre-built connectors.
• CI-driven security: Using automated schema validation to maintain detection library integrity. Pitfall: Lack of testing and validation leads to detections that fail due to underlying environmental assumptions.

References:

• https://dev.to/barrosleo/designing-detection-as-code-without-a-siem-1k7f
• https://github.com/Barrosleo/bluephoenix-detection-lab