Build an automated detection testing framework with GitLab CI/CD and Duo

This article describes WATCH (Weekly Attack Testing for Continuous Health), GitLab's automated detection testing framework that validates security detections work end-to-end.

• •WATCH simulates malicious behavior in staging environments and verifies that alerts propagate through the SIEM, SOAR, and monitoring dashboards
• •The framework uses three GitLab CI/CD pipeline stages: scheduling weekly tests with randomized timing, executing attack simulations, and verifying alerts were generated
• •The BaseSecurityTest abstract class provides a simple interface requiring only setup(), execute(), and cleanup() methods plus expected_detections declaration
• •Tests are discovered automatically from the tests/ directory, making it easy for any team member to add new detection tests
• •