Update Handbook pages to remove Signals Engineering and add Detection Engineering

- [Trust & Safety](/handbook/security/security-operations/trustandsafety/) - Prevention and mitigation of abuse of the GitLab.com platform

- [Red Team](/handbook/security/security-operations/red-team/) - Adversary emulation

- [Threat Intelligence](/handbook/security/security-operations/threat-intelligence/) - Actionable insights on real-world threats

- [Signals Engineering](/handbook/security/security-operations/signals-engineering/) - Detection Engineering

- [Detection Engineering](/handbook/security/security-operations/detection-engineering/) - Detection Engineering

- [Security Logging](/handbook/security/security-operations/security-logging/) - SIEM and logging management

## Contacting Security Operations

---

title: Signals Engineering Team (SET)

title: Detection Engineering Team

---

## Engaging Signals Engineering

## Engaging Detection Engineering

Teams can engage Signals Engineering by heading over to the #signals-engineering slack channel. SIRT can also engage Signals Engineering for detection and alert tuning needs by selecting the "report a bug" feature in GUARD.

Teams can engage Detection Engineering by heading over to the #detection-engineering slack channel. SIRT can also engage Detection Engineering for detection and alert tuning needs by selecting the "report a bug."

## Our Vision

Improving Security Observability

- Partnering with the Product, Engineering and Infrastructure teams to improve GitLab security signals

- Partnering with CorpSec and ProdSec to improve security signals in corporate, cloud, and identity infrastructure

- Partnering with the Product, Engineering and Infrastructure teams to improve GitLab security detection coverage

- Partnering with CorpSec and ProdSec to improve security detection capabilities in corporate, cloud, and identity infrastructure

Providing Customer Value

| Team Member | Role |

|---|---|

| Matt Coons | [Senior Security Manager](/job-description-library/security/security-leadership/) |

| Harjeet Sharma | [Principal Security Engineer, Signals Engineering](/job-description-library/security/security-engineer/#signals-engineering) |

| Evan Baltman | [Security Engineer, Signals Engineering](/job-description-library/security/security-engineer/#signals-engineering) |

| Shashi Priyatham Chitakodur | [Associate Security Engineer, Signals Engineering](/job-description-library/security/security-engineer/#signals-engineering) |

| Joanna Rubi | [Senior Security Engineer, Signals Engineering](/job-description-library/security/security-engineer/#signals-engineering) |

| Harjeet Sharma | [Principal Security Engineer, Detection Engineering](/job-description-library/security/security-engineer/#detection-engineering) |

| Shashi Priyatham Chitakodur | [Associate Security Engineer, Detection Engineering](/job-description-library/security/security-engineer/#detection-engineering) |

| Joanna Rubi | [Senior Security Engineer, Detection Engineering](/job-description-library/security/security-engineer/#detection-engineering) |

### Our Stakeholders

While Signals Engineering has dedicated engineers focussed on advancing projects and handling operational duties, there are a number of stakeholders both within the Security Division and beyond that Signals Engineering collaborate with to drive results.

While Detection Engineering has dedicated engineers focussed on advancing projects and handling operational duties, there are a number of stakeholders both within the Security Division and beyond that Detection Engineering collaborates with to drive results.

| Stakeholder | Shared Responsiblities/Dependencies |

|---|---|

| Threat Intel | Threat driven detections, Top threat actor detections |

| GitLab Customers | Consumer of customer facing detections |

| Product team | Collaboration to improve security signal capabilities |

| CorpSec | Collaboration to collect signals from purchased tooling |

| Security Identity Team | Collaboration to collect signals from purchased tooling |

| Red Team | Collaboration to collect signals from purchased tooling |

| Product Security | Collaboration to collect signals from purchased tooling |

### Current Priorities

In the first 6 months (FY25Q4 - FY26Q1), we are focusing on "Low hanging fruit" and establishing the Signals Engineering program.

Some highlights include:

1. Reducing alert false positives & improving FP alerting/handling workflow

2. Initial metrics creation & label standardization

3. Improving customer facing detection creation & sharing process

4. Writing new detections to close identified detection gaps

As the program matures, we will expand our focus to improve our automation and maturity as well as bolstering our customer detection capabilities.

| CorpSec | Collaboration to collect security telemetry from purchased tooling |

| Security Identity Team | Collaboration to collect security telemetry from purchased tooling |

| Red Team | Collaboration to complete purple teams and testing detection capabilities |

| Product Security | Collaboration to build accurate and comprehensive security telemetry |

## What we've Built & Services we Offer

GUARD (GitLab Universal Automated Response and Detection) is the Security Team's Detections as Code (DaC) pipeline and alerting automation framework. GUARD hands off an alert to the SIRT incident handling process stops when an alert is converted into a SIRT incident.

GUARD is a shared responsibility model between Signals Engineering and SIRT - Both SIRT and Signals Engineering build threat detections and have the ability to commit new and maintain existing detections in GUARD.

GUARD is a shared responsibility model between Detection Engineering and SIRT - Both SIRT and Detection Engineering build threat detections and have the ability to commit new and maintain existing detections in GUARD.

#### Threat Detection Tuning

When SIRT identifies a threat detection that needs to be tuned, tuning requests are submitted to the Signals Engineering team for improvements.

When SIRT identifies a threat detection that needs to be tuned, tuning requests are submitted to the Detection Engineering team for improvements.

#### Threat Detection Creation

The Signals Engineering team tracks detection coverage and builds new threat detections based on several needs:

The Detection Engineering team tracks detection coverage and builds new threat detections based on several needs:

1. Gaps in detection capabilities as identified by SIRT or Signals Engineering

1. Gaps in detection capabilities as identified by SIRT or Detection Engineering

2. Collaboration with T&S to improve the ability to identify potential abuse on the GitLab platform

3. New detections for new log sources that can be queried in GitLab's SIEM

4. New attacker TTPs

5. Collaboration with the Red Team as part of purple team or stealth engagements

### Signals & Detection Research

### Detection Research

Signals engineers conduct deep dive research into potential observability gaps and signals enhancement opportunities, identified in the GitLab product and 3rd party tools GitLab uses. Such research assignments have a target deliverable of new detections as well as improved observability capabilities.

Detection engineers conduct deep dive research into potential observability gaps and security telemetry enhancement opportunities, identified in the GitLab product and 3rd party tools GitLab uses. Such research assignments have a target deliverable of new detections as well as improved observability capabilities.

## How We Measure Success

We measure the success of Signals Engineering by collecting and reporting on key performance indicators, through metrics collected from MRs, issues and alerting metrics.

Initial metrics we report on are listed below:

### Alerting & Tuning

1. TP/FP ratio + trending

2. Alert Bug report volume

### Incidents

1. Number of S1 incidents with signal gaps

### Value for Customers

1. Number of public detections

### Detection coverage

1. MITRE coverage

2. Coverage by log sources

3. MTTDC (Mean time to detection creation)

4. Coverage by threat actor

### Metric Labels

- `SET::Detection-New`

- `SET::Detection-Maintenance`

- `SET::Research`

- `SET::Signals-Improvement`

- `SET::Cross-Functional`

- `SET::Signal-Gap`

We measure the success of Detection Engineering by collecting and reporting on key performance indicators, through metrics collected from MRs, issues and alerting metrics.

### Purple Teaming

Purple Team represents a collaborative exercise between the Red Team and Blue Team (our defensive teams, usually [SIRT](../sirt/) or [Signals Engineering](../signals-engineering)). These can be:

Purple Team represents a collaborative exercise between the Red Team and Blue Team (our defensive teams, usually [SIRT](../sirt/) or [Detection Engineering](../detection-engineering)). These can be:

- flash operations, which are 1-2 week exercises triggered by [Threat Intelligence Flash Reports](../threat-intelligence/#threat-intelligence-reports) to rapidly test our defenses against emerging threats, or

- longer-term collaborations

We then release a [report](#reporting) summarizing the operation and our recommendations for improving security posture. We create issues using the [issue template](https://gitlab.com/gitlab-com/gl-security/security-operations/redteam/redteam-public/resources/red-team-issue-templates), apply the relevant labels, and use this to track [metrics](#red-team-metrics). We then provide our tools and techniques to the Blue Team so they can create relevant detections.

We often work with [Signals Engineering](../../signals-engineering/) and [Security Incident Response Team (SIRT)](../../sirt/) to review our findings, attack steps and review detections and alerts.

We often work with [Detection Engineering](../../detection-engineering/) and [Security Incident Response Team (SIRT)](../../sirt/) to review our findings, attack steps and review detections and alerts.

#### Security recommendations across GitLab

- Excellent understanding of application security issues and how to fix application security vulnerabilities

- Track record of delivering results through the entire software development lifecycle

### Signals Engineering

### Detection Engineering

Signals engineers build and maintain security observability capabilities and transform those capabilities into actionable signals and detections to detect attacker behaviors. An understanding of the GitLab product and a passion for diving deep into attacker behaviors is a key competency in this role. Signals engineers are able to think like an incident responder, research and test attacker TTPs, maintain relationships with product stakeholders, and empower the business to build and improve security logging and detection capabilities.

Detection engineers build and maintain security observability capabilities and transform those capabilities into actionable security telemetry and detections to detect attacker behaviors. An understanding of the GitLab product and a passion for diving deep into attacker behaviors is a key competency in this role. Detection engineers are able to think like an incident responder, research and test attacker TTPs, maintain relationships with product stakeholders, and empower the business to build and improve security logging and detection capabilities.

Signals Engineering Team Responsibilities:

Detection Engineering Team Responsibilities:

- Develop and improve security signal creation at GitLab - including the GitLab product, corporate, cloud and identity infrastructure.

- Map detection capabilities to breach concerns, identifying critical signals to detect behaviors of interest.

- Develop and improve security detection creation at GitLab - including the GitLab product, corporate, cloud and identity infrastructure.

- Map detection capabilities to breach concerns, identifying critical security telemetry to detect behaviors of interest.

- Understand the implications of an attack, vulnerability, or gap in security observability, and be able to translate that gap into an opportunity to improve overall security observability.

- Sit at the intersection of Security Operations, Infrastructure and Product teams in a powerful position to create threat detection rules, identify and empower the business to implement security observability improvements for internal threat detections and customer security observability needs.

- Dogfood the GitLab product observability capabilities through product logging such as the GitLab audit log.

- Build and report on signals engineering metrics.

- Build and report on detection engineering metrics.

- Participate in high severity security incidents with a focus on identifying gaps in observability, building new threat detection rules, and reducing the mean time to detection creation.

Signals Engineering Team Requirements:

Detection Engineering Team Requirements:

- A passion for AI (Artificial Intelligence) with goals to implement it in all parts of detection engineering

- Ability to write complex threat detection engineering rules