Published on14 November 2025Detection as Code: Treating Your Rules Like SoftwareDetection-EngineeringDetection-as-CodeSigmaMITRE-ATT&CKCI/CDVersion control, CI testing, and ATT&CK coverage mapping turned a folder of SIEM rules into an engineering discipline. What changed, what it cost, and what I would do differently.