---
id: 2635
title: "Build an automated detection testing framework with GitLab CI/CD and Duo"
source_domain: about.gitlab.com
source_url: "https://about.gitlab.com/blog/automated-detection-testing-framework/"
published_at: "2026-04-30 00:00"
tags: ["gitlab", "devsecops", "siem", "threat-detection", "detection-engineering", "ci-cd", "soc", "soar", "breach-and-attack-simulation", "breach-attack-simulation"]
phying_url: "https://phying.com/item/2635"
lang: en
---

# Build an automated detection testing framework with GitLab CI/CD and Duo

## Summary

GitLab's Signals Engineering team built WATCH, a breach and attack simulation framework that runs real malicious behavior to verify detections fire end-to-end from log source through SIEM and SOAR.

## Intelligence Metadata

- **Sources:** about.gitlab.com
- **Published:** 2026-04-30 00:00
- **Original:** https://about.gitlab.com/blog/automated-detection-testing-framework/
- **Phying News:** https://phying.com/item/2635