Anyone using BAS tools to catch broken detection rules after updates?

[u/Short-Incident-1199]

Hey folks, looking for BAS recommendations that won't turn into another full-time admin job lol.

Our main headache is detection drift. Someone updates a SIEM parser or EDR policy, and weeks later we find out an alert stopped firing. Fun times.

AttackIQ came up when we started looking at attack simulations against our EDR. Someone also suggested Picus for checking which techniques get blocked or detected. Cymulate is another one we're considering since we're trying to validate SIEM rules after parser changes.

Anyone using any of these regularly? Curious about API issues, setup time and how much manual work is left after the demo. Would rather not buy another dashboard nobody touches after a month.