Automating detection gap analysis with GitLab Duo Agent Platform
GitLab’s Signals Engineering team uses GitLab Duo Agent Platform to automate detection gap analysis after security incidents. The approach replaces inconsistent manual reviews with AI agents that examine incident issues, map attacker behavior to MITRE ATT&CK, and recommend actionable detection improvements. GitLab recommends starting with the built-in Security Analyst Agent, then creating a custom agent when organization-specific context is required. ## The Detection Gap Problem - A detection gap occurs when an attacker performs an action that existing detections fail to identify. - Reviewing gaps requires analysts to: - Read incident timelines, comments, and related artifacts. - Map attacker actions to detection opportunities. - Identify missing or insufficient alerts. - Recommend concrete detection improvements. - Manual analysis is time-consuming, inconsistent across reviewers, and easy to postpone. - GitLab embeds this process in the workflow where incidents already reside: GitLab issues. ## GitLab Duo Agent Platform - Duo Agent Platform supports agents that can reason, take actions, and interact with GitLab resources such as issues, merge requests, and code. - Teams can either: - Use pre-built agents with existing domain knowledge. - Build custom agents using a name, description, and system prompt. - The system prompt defines the agent’s role, knowledge, tools, and expected behavior. ## Security Analyst Agent - The built-in Security Analyst Agent can be invoked directly from a closed incident issue. - It reviews: - Incident descriptions and timelines. - Tasks and comments. - Linked artifacts and other issue content. - It can identify missed attacker tactics, techniques, and procedures and map them to MITRE ATT&CK. - It is useful for quick, low-configuration assessments, particularly when incident documentation is thorough. - Its limitation is a lack of knowledge about an organization’s specific SIEM, log sources, detection stack, and engineering standards. ## Detection Engineering Assistant - GitLab created a custom agent to provide recommendations tailored to its environment. - Building the agent requires only: - A name. - A description. - A system prompt. - The system prompt is central to the agent’s usefulness; detailed instructions produce more consistent and relevant results. ### Defining the Agent’s Role - The prompt explicitly identifies the agent as a detection engineering assistant responsible for analyzing incidents and finding coverage gaps. - Clear framing helps anchor the agent’s responses to the team’s actual responsibilities. ### Encoding Detection Principles - GitLab describes its preferred detection characteristics: - Low false-positive rates. - High signal fidelity. - Actionable alerts with useful response context. - The prompt favors behavioral detections over indicator-of-compromise approaches when practical. - It also addresses the tradeoff between broad coverage and alert fatigue. ### Providing Environment and Telemetry Context - The agent is told which log sources are available, what SIEM is used, and what telemetry is missing. - This prevents it from recommending detections that depend on data the team cannot access. ### Structuring Findings with MITRE ATT&CK - Gap findings are organized around ATT&CK tactics and techniques. - This provides consistent reporting and supports internal coverage tracking and prioritization. ### Standardizing Output - Each finding should include: - The relevant ATT&CK technique. - What attacker behavior was missed. - The log source or data needed for detection. - A recommended detection approach. - Consistent formatting makes findings easier to triage and convert into engineering work. - GitLab’s full system prompt contains 1,870 words and 337 lines, illustrating the level of detail used to tailor the agent. ## Practical Recommendation Use the Security Analyst Agent for an immediate first pass, but build a custom detection engineering agent when recommendations need to reflect your own telemetry, tooling, standards, and detection philosophy. A detailed system prompt is the key to turning general AI analysis into repeatable, actionable security engineering work.
Read original(opens in new tab)
