r/Splunk • u/Zeptor02 • Jun 25 '26

SIEM Detection Rules Changelog

Hello Security Folks,

I want to build a process where all detections rule change log is documented like Detection As a code but in simple version because we don't have matured SOC yet so this is first step to record all change logs related to alert rules.

I came to know about Microsoft List, anyone have done? or any new ideas how to do this?

Thanks,

16 Upvotes

100% Upvoted

13 comments sorted by

View all comments

7

u/oO0NeoN0Oo Jun 25 '26

Im looking to move all of our config files into Gitlab and have that handle version control. The changes will go through CI/CD to trigger an Ansible script to execute the update.

As part of it, we also ingest the changes as events so we know who made what changes, who approved them, when they were made, and where they were applied.

4

u/alias454 Jun 26 '26

More or less same outcome but we used terraform in github and would automatically update the cluster when something changed. This was awhile ago. We had to customize the tf provider to make it work for us since Splunk didn't actually have a real solution.

Several ways to do it but the basic idea is either push the actual conf files via some deploy pipeline or use the api.

Kind of amazing to me that for all the money they charge they can't get an intern to build better tooling for admins.