Detection as Code

Data: the maturity matrix as CSV and JSON

The matrix and the rubric scores are published as two files under CC BY 4.0. Credit Detection as Code and link to this page.

What is in the files

14 platforms and 33 capabilities. Status values are documented, partial and not documented. The maturity score is documented counts 1 and partial counts 0.5, over 33; maturity_core_30 is the same count over the 30 capabilities outside the Library group. The JSON adds the eight rubric criteria with weight, score, status, reason, sources and read dates, and the weighted total for each platform. Dataset last modified 2026-11-04; cells read 2026-11-03.

Platforms in the dataset with documented, partial and not documented counts, the matrix score of 33 and the rubric total of 10.

PlatformDoc / part / noneMatrixRubric
Panther14 / 8 / 1118.06.31
Elastic Security11 / 11 / 1116.57.60
Google Security Operations11 / 8 / 1415.06.83
Splunk Enterprise Security (Cisco)10 / 7 / 1613.56.21
Microsoft Sentinel10 / 5 / 1812.57.81
Sigma and pySigma10 / 4 / 1912.05.50
Sekoia.io6 / 10 / 1711.03.46
Anvilogic0 / 13 / 206.55.48
Hunters3 / 7 / 236.53.44
SOC Prime0 / 10 / 235.05.11
Detecteam0 / 7 / 263.55.26
Mate Security0 / 7 / 263.53.98
CardinalOps (Cribl)0 / 7 / 263.53.96
SnapAttack (Cisco)0 / 0 / 330.04.61

Using the data

A status says what a reader following public pages would find. It does not say a feature is absent. Cite the read date with any figure you take, and check the source page before you rely on a cell, because vendors change their documentation. The matrix method and the rubric explain how each number is set. Send corrections to editor@detectionascode.com.