Rapid7 Brings Detection as Code to Incident Command and InsightIDR
Summary
Rapid7 says its Terraform provider for Detection as Code is available across Incident Command and InsightIDR tiers, bringing version control, peer review, testing, rollback, and rule import to detection management.
Key points
- The provider manages detection rules through Terraform, supporting version control, peer review, testing, rollback, and change traceability.
- The article demonstrates a rule for detecting encoded PowerShell execution, mapped to MITRE ATT&CK technique T1059.001.
- Inline positive and negative test cases are intended to check that a rule detects matching activity without alerting on benign activity.
- Terraform plan previews changes, while Terraform state records the detection environment.
- Existing UI-built rules can be imported using the provider's Terraform command.
- Rapid7 says AI-assisted IDE configurations can help draft detections for engineer review.
Article Details
- Event Type
- Rapid7 announced the availability of its Terraform provider for Detection as Code across all Incident Command and InsightIDR tiers.
- Impact
- The provider enables security teams to manage detection rules through version control, peer review, automated testing, and rollback. The article demonstrates a high-priority detection for encoded PowerShell execution.
MITRE ATT&CK
Vendors
Products
Tools
Claude CodeThe workflow supports importing existing UI rules and using AI tools like Claude Code, Cursor, VS Code Copilot, and Kiro to draft detections faster.CursorThe workflow supports importing existing UI rules and using AI tools like Claude Code, Cursor, VS Code Copilot, and Kiro to draft detections faster.KiroThe workflow supports importing existing UI rules and using AI tools like Claude Code, Cursor, VS Code Copilot, and Kiro to draft detections faster.TerraformThe article explains how Detection as Code brings software engineering discipline to security detections by adding version control, peer review, testing, rollback, and traceability through Terraform.VS Code CopilotThe workflow supports importing existing UI rules and using AI tools like Claude Code, Cursor, VS Code Copilot, and Kiro to draft detections faster.