Detection GitHub Actions

gha → CI pipeline for sigma rules

Configure the GitHub Actions CI/CD pipeline for detection rules, automating Sigma validation and deployment to the SIEM.

Use it when you want detection-as-code with CI/CD: the GitHub Actions workflow validates the Sigma rules in the repo (syntax with sigma-cli), converts them to SIEM backends, and deploys them (or generates the deployment artifact) on each push. It's the detection pipeline: the rule versioned, validated, and deployed automatically — the same software development flow applied to detections. In purple teaming and detection engineering, detection CI/CD is the mature practice: the rules repo with the pipeline (validate → convert → deploy) and rollback (the noisy rule is reverted with git).

Don't use it without the repo and SIEM defined: the pipeline needs the rules repo (the structure) and the destination (the SIEM API or artifact) — without the destination, the pipeline validates and converts but doesn't deploy. And watch out: automatic deployment without prior validation (rules tested against real data) generates noise in production — the pipeline is configured with phased deployment (first to a test SIEM) or manual PR review. Pipeline secrets (SIEM credentials) are managed with GitHub secrets. The pipeline is the automation, rule quality is the team's.