DtSR Episode 730 - Matt Coons Agentic Detection Engineering

Show notes

TL;DR: Stop vibe-coding your detections! This week's pod features Matt Coons at GitLab as we talk about detection engineering, but with AI agents.

Guest

Matt Coons

Description

Your detection backlog is endless, your alert queue never stops, and “just tune it out” quietly creates blind spots. From the floor of BSides Atlanta, we sit down with Matt Coons from GitLab to talk about a different path: agentic detection engineering that moves faster while staying provable, testable, and human-owned.

We get concrete about what changes when AI agents enter the loop. Matt explains how end-to-end validation can work in practice, from running real API calls to ensuring the right events land in the logging platform and trigger the intended rule. We also unpack the difference between detection engineering and detection tuning, why time-bound tuning beats “mute forever,” and where human judgment still matters when an agent suggests exclusions that might hide real malicious behavior.

A big theme is designing security operations for scale. We explore signals versus detections, grouping signals by entity to expose patterns, and using multi-agent triage to reduce SOC burnout without losing visibility. Matt shares how model tiering can control cost, why newer frontier models can deliver more production-ready detection content, and why the real bottleneck is shifting toward human approval and accountability. We also hit prompting discipline, skill files, and how to get summaries that are actually shorter than the original.

If you care about AI in cybersecurity, SOC automation, threat hunting, MITRE ATT&CK coverage, and reducing false positives while catching more real incidents, this one is for you. Subscribe, share it with a teammate, and leave a review, then tell us: what part of your detection workflow would you trust an agent to handle first?

Have something to say? Let's hear it.

Support the show

>>> Please consider clicking the link above to support the show!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq
LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/
X/Twitter: https://twitter.com/dtsr_podcast

← Previous

DtSR Episode 729 - Xavier Ashe 1 A.M. at Sprint: The Night Yahoo Went Down

TL;DR: Stop vibe-coding your detections! This week's pod features Matt Coons at GitLab as we talk about detection engineering, but with AI agents. Guest Matt Coons Description Your detection backlog is endless, your alert queue never stops, and “just tune it out” quietly creates blind spots. From the floor of BSides Atlanta, we sit down with Matt Coons from GitLab to talk about a different path: agentic detection engineering that moves faster while staying provable, testable, and human-owned. We get concrete about what changes when AI agents enter the loop. Matt explains how end-to-end validation can work in practice, from running real API calls to ensuring the right events land in the logging platform and trigger the intended rule. We also unpack the difference between detection engineering and detection tuning, why time-bound tuning beats “mute forever,” and where human judgment still matters when an agent suggests exclusions that might hide real malicious behavior. A big theme is designing security operations for scale. We explore signals versus detections, grouping signals by entity to expose patterns, and using multi-agent triage to reduce SOC burnout without losing visibility. Matt shares how model tiering can control cost, why newer frontier models can deliver more production-ready detection content, and why the real bottleneck is shifting toward human approval and accountability. We also hit prompting discipline, skill files, and how to get summaries that are actually shorter than the original. If you care about AI in cybersecurity, SOC automation, threat hunting, MITRE ATT&CK coverage, and reducing false positives while catching more real incidents, this one is for you. Subscribe, share it with a teammate, and leave a review, then tell us: what part of your detection workflow would you trust an agent to handle first? Have something to say? Let's hear it. Support the show >>> Please consider clicking the link above to support the show! -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= YouTube home: https://youtube.com/playlist?list=PLyo0dkKRvfVtWXjRxNISrhme1MgBj3C2U&si=scHDiTuLXSEQ9qHq LinkedIn Page: https://www.linkedin.com/company/down-the-security-rabbithole-podcast/ X/Twitter: https://twitter.com/dtsr_podcast