Automated security detection assurance system with rule-as-code management and integrated posture testing

Abstract

The present disclosure provides a computer-implemented system for automated security detection assurance comprising a processor, a memory coupled to the processor, and a rule repository storing a plurality of detection rules in a code format. Each detection rule comprises an injector component defining how to artificially generate security data and a watcher component defining expected detection outcomes. The system includes a watchdog manager component executed by the processor and configured to automatically retrieve the detection rules from the rule repository, execute the injector components to generate simulated security events, monitor a security information and event management (SIEM) system for detection outcomes corresponding to the simulated security events, and compare the monitored detection outcomes with the expected detection outcomes defined in the watcher components. A notification component generates alerts when the monitored detection outcomes deviate from the expected detection outcomes.