CI pipeline

A CI pipeline is the automated sequence that runs on each change to the rule repository: lint, validate, test and, on merge, deploy. It is what makes detection as code repeatable. A rule that fails a check never reaches production.

What CI pipeline means here

A typical sequence runs the rule validator, then unit tests, then a deploy step that calls the SIEM's API with a token held as a secret.

Check whether the vendor ships example workflows. Writing the first pipeline from scratch is the slow part.

Example of CI pipeline in Panther documentation

Panther documents workflow YAML for GitHub Actions and CircleCI to test and upload content, and its docs index has no GitLab CI page. docs.panther.com read 2026-11-03

Terms related to CI pipeline

• Pull request workflow: A pull request workflow is how a rule change is proposed, reviewed and approved before it ships.
• Rule unit test: A rule unit test runs a detection against a small set of sample events and checks whether it alerts on the ones it should and stays quiet on the others.
• Detection as code: Detection as code means detection rules live in a version-controlled repository, change through reviewed pull requests, and reach the SIEM through a pipeline instead of console edits.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.