We Tried to Automate Detection Engineering. The Data Wasn't There (unfold.ai)

A team has launched a public portal aimed at enhancing detection engineering for server applications, uncovering significant blind spots in logging capabilities during their process. The initiative revealed that many common attack techniques, notably in CI/CD environments like Jenkins and Citrix, are not adequately logged, often leaving defenders unaware of critical security incidents. For instance, while Jenkins can log the execution of scripts, it fails to capture sensitive actions such as credential dumps or unauthorized build modifications, creating a dangerous gap in visibility and response. This research underscores the crucial need for transparency in logging systems, as vendor documentation typically does not highlight what is missing from logs. With around 75% of assessed techniques showing limited visibility, defenders are left vulnerable to emerging threats that are not captured in standard logs or configurations. The newly launched portal (accessible at portal.unfold.ai) allows security teams to proactively assess what can be detected in their systems, evaluate blind spots, and make informed decisions about enhancing their logging strategies. This approach aims to bridge the gap between known threats and actual logging capabilities, fostering a more robust defense against potential breaches.