About Detection as Code

A capability matrix and head-to-heads for detection engineering tooling, checked against public documentation.

Detection as Code is a reference for detection engineers and SOC leads who keep rules in git, ship them from a pipeline, and want to know which products document that workflow. The core of the site is a capability matrix: 12 tools profiled against 33 capabilities in six groups (languages, source control and CI, testing, coverage analytics, rule health and library), with a status, a one-line note, a source link and a read date on every cell.

Next to the matrix sit head-to-head pages for every pair of the 12 tools, an alternatives page for each, buyer-type rankings, a glossary of 36 terms, dated notes and a 30-question FAQ. Rule health gets its own group and 18 of the 100 weighted points, because a rule that stops running or floods the queue is the failure a detection team meets most often.

Every score comes from public documentation, repositories and vendor pages, read on the date shown beside it. Scores are set from a published rubric of eight weighted criteria and computed from a weights file, so a total always equals the sum of its parts. Where two totals are within 0.25 of each other, the page calls them a band, not a ladder. A vendor cannot pay to change a score. Open-source tooling such as Sigma and pySigma is scored on the same rubric and labelled as tooling.

Application security scanning and infrastructure-as-code tools are out of scope.

How scores are set: editorial policy and rubric. Contact: editor@detectionascode.com.