# Our Approach to Building Security Tooling

DevFeed: [Our Approach to Building Security Tooling](<https://devfeed.tech/articles/our-approach-to-building-security-tooling-29177.md>)

Original publisher: [Read original article](<https://www.latacora.com/blog/2023/11/01/our-approach-to-building-security-tooling/>)

Published: 2023-11-01T16:00:00Z

Content type: article

Language: en

Sources: [Latacora](<https://devfeed.tech/sources/latacora.md>)

Topics: [Tooling](<https://devfeed.tech/topics/tooling.md>), [Security](<https://devfeed.tech/topics/security.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>), [Incident response](<https://devfeed.tech/topics/incident-response.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [building](<https://devfeed.tech/tags/building.md>), [code](<https://devfeed.tech/tags/code.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [data](<https://devfeed.tech/tags/data.md>), [fetching](<https://devfeed.tech/tags/fetching.md>), [github](<https://devfeed.tech/tags/github.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [security](<https://devfeed.tech/tags/security.md>), [snapshot](<https://devfeed.tech/tags/snapshot.md>), [storage](<https://devfeed.tech/tags/storage.md>), [tooling](<https://devfeed.tech/tags/tooling.md>)

## AI overview

The article describes a security-tooling strategy that captures all available API data, stores it in its original request-and-response format as snapshots, and evaluates it later through queries. This is presented as more flexible than tools that fetch only data needed for predefined findings, particularly for exploratory work and incident response.

## Source excerpt

Introduction # Most "security tools" today are typically composed by code that consumes an API and applies predefined logic to identify issues. This is generally accomplished by: Fetching a subset of the endpoints exposed by the service / API being audited (that is, the information required for the evaluation logic, such as a list of the EC2 instances deployed in an AWS account, as well as their configuration) Storing the data retrieved Evaluating this data to produce "findings" (this is the added value provided by the tool) Integrating third party tools into our monitoring platform isn't always straightforward, as each tool: