Devo & Detecteam Automate Detection Engineering for Stronger Security Posture

### Overview Recorded live at RSA Conference 2025 at the Cyber TV studio, host Adrian Sanabria speaks with Jason Michael, Field CTO at Devo, regarding the integration and partnership between Devo and Detecteam. The conversation focuses on automating detection engineering, continuously validating security controls through attack simulations, and moving away from traditional, highly manual detection workflows in the SOC.

### Key Topics - **Platform Capabilities**: Devo operates as a cloud-native, data-agnostic security data analytics platform delivering real-time streaming analytics without requiring delay for data processing or indexing. Detecteam provides an automated attack simulation engine that ingests threat reports (such as CISA alerts) via AI, extracts Tactics, Techniques, and Procedures (TTPs) in seconds, and generates live simulation scenarios. - **The Broken Detection Lifecycle**: Historically, security teams spend days or weeks reviewing threat reports and hand-crafting detection rules. Furthermore, organizations rarely test these rules prior to being attacked, meaning failures or parser breakages go unnoticed until an incident occurs. - **QA and Continuous Testing in Security**: A recurring challenge is that security personnel frequently lack software quality assurance backgrounds. Examples like the Equifax breach illustrate how rules (e.g., Snort rules deployed without verification) can fail in production. Log schema changes, platform version upgrades, or subtle attacker evasions can quietly break detections if ongoing validation does not occur. - **Automation and Workflow Integration**: The integration between Devo and Detecteam connects via APIs across both SaaS platforms. Detecteam replicates the customer's specific technology stack (EDR, firewalls, proxies) to generate environment-accurate telemetry and attack simulations, while Devo automatically ingests and parses the data to verify detection rules fire and alerts render properly. - **Operational Cadence and MSSP Use Cases**: Detection testing can run ad hoc when new threats emerge or on a scheduled basis (weekly, monthly, quarterly) to support purple teaming, tabletop exercises, and incident response playbook verification. For MSSPs and MDR providers, this multi-tenant integration allows automated validation against customer SLAs to prove detection coverage. - **Collaborative Defense and Rule Sharing**: While the cybersecurity community widely shares threat intelligence and IOCs, detection rules have historically remained siloed and proprietary. Devo leverages its "Exchange" community platform to share validated detection rules across users.

### Technical Details - **Integration Architecture**: API-based integration between Devo's security analytics platform and the Detecteam tenant. Enables automated deployment of detection rules and telemetry injection directly into the SIEM/analytics engine. - **Telemetry Customization**: Users specify their active security stack inside the Detecteam simulator library (firewall, proxy, EDR) to ensure telemetry closely mirrors live production event logs, pre-parsed to match Devo's detection formats. - **Rule Verification**: Validates detection logic beyond fragile static indicators (like file hashes) by simulating TTP variants and evasions to confirm detection rules and downstream automated response playbooks trigger as intended.

### Takeaways - Manual detection engineering and rule maintenance create unsustainable bottlenecks and contributor burnout (alert fatigue and threat intel fatigue). - Continuous, automated attack simulation is critical to ensure detection rules, parsers, and incident response playbooks function before an actual attack occurs. - Security operations benefit from moving toward a "build once, use many" collaborative approach, sharing detection logic across organizations via platforms like Devo Exchange.