{ "site": "detectionascode.com", "license": "CC BY 4.0", "modified": "2026-11-04", "read_date": "2026-11-03", "scoring": "documented = 1, partial = 0.5, not documented = 0; maturity_score over 33 capabilities; maturity_core_30 over the 30 capabilities outside the Library group.", "capabilities": [ { "id": "sigma_native", "group": "Languages", "name": "Sigma native", "definition": "Rules written in Sigma YAML are stored and run by the platform without a conversion step.", "proof": "A docs page stating that Sigma rules are authored, imported or executed natively." }, { "id": "sigma_conversion", "group": "Languages", "name": "Sigma via conversion", "definition": "Sigma rules can be converted to the platform's query language by a documented tool or backend.", "proof": "A docs or repo page naming a converter, backend or translation feature that outputs this platform's language." }, { "id": "yara_l", "group": "Languages", "name": "YARA-L", "definition": "Detections can be written in YARA-L 2.0.", "proof": "A docs page describing YARA-L rule authoring on the platform." }, { "id": "spl", "group": "Languages", "name": "SPL", "definition": "Detections can be written as Splunk SPL searches.", "proof": "A docs page describing SPL-based detections or correlation searches." }, { "id": "kql", "group": "Languages", "name": "KQL (Kusto)", "definition": "Detections can be written in Kusto Query Language.", "proof": "A docs page describing KQL-based analytics rules or detection rules." }, { "id": "eql_esql", "group": "Languages", "name": "EQL or ES|QL", "definition": "Detections can be written in Elastic EQL or ES|QL.", "proof": "A docs page describing EQL or ES|QL rule types." }, { "id": "python_detections", "group": "Languages", "name": "Python detections", "definition": "Detection logic can be written as Python functions or scripts that the platform runs.", "proof": "A docs page describing Python detection authoring." }, { "id": "visual_builder", "group": "Languages", "name": "Vendor visual builder", "definition": "A no-code or form-based builder produces the detection logic without hand-writing a query.", "proof": "A docs page naming a builder, detection wizard or no-code editor that generates logic." }, { "id": "yara", "group": "Languages", "name": "YARA", "definition": "File or memory signatures can be authored as YARA rules inside the detection workflow.", "proof": "A docs page describing YARA rule support as detections." }, { "id": "lucene_kql_like", "group": "Languages", "name": "Lucene or KQL-like query", "definition": "Detections can use Lucene syntax, Kibana KQL, or a platform pipe or filter query language similar to KQL.", "proof": "A docs page naming the query syntax used for detection rules." }, { "id": "git_sync", "group": "Source control and CI", "name": "Git repository sync documented", "definition": "Detection content can be kept in a git repository that stays in sync with the platform.", "proof": "A docs or official repo page describing repository connection, sync or a repo layout used as source of truth." }, { "id": "pr_deployment", "group": "Source control and CI", "name": "Pull-request based deployment", "definition": "A merged or opened pull request triggers validation or deployment of detections.", "proof": "A docs page or shipped workflow where pull request events run tests or deploy rules." }, { "id": "cli_validate_deploy", "group": "Source control and CI", "name": "CLI for validate and deploy", "definition": "A command-line tool validates rule files and pushes them to the platform.", "proof": "A docs page listing CLI commands for validation and upload or deploy." }, { "id": "api_rule_crud", "group": "Source control and CI", "name": "API for rule CRUD", "definition": "Rules can be created, read, updated and deleted through a documented API.", "proof": "An API reference or docs page listing rule create, update, get and delete operations." }, { "id": "ci_examples", "group": "Source control and CI", "name": "Pre-built CI examples", "definition": "The vendor publishes ready CI pipeline definitions (GitHub Actions, GitLab CI or similar) for detection content.", "proof": "A docs page or repo containing workflow YAML for detection content." }, { "id": "env_promotion", "group": "Source control and CI", "name": "Environment promotion", "definition": "Detections move between dev, staging and prod environments through a documented flow.", "proof": "A docs page describing multiple environments or staged promotion of rules." }, { "id": "unit_tests", "group": "Testing", "name": "Unit tests with sample events", "definition": "Each detection can carry test events and expected outcomes that run automatically.", "proof": "A docs page describing test cases or unit tests with sample or recorded events." }, { "id": "replay_historical", "group": "Testing", "name": "Replay against historical data", "definition": "A rule can be run over past data to preview results before or after enabling it.", "proof": "A docs page describing historical test runs, retrohunts or data replay." }, { "id": "synthetic_events", "group": "Testing", "name": "Synthetic event generation", "definition": "The platform or its tooling generates attack-like events to exercise detections.", "proof": "A docs or product page describing event simulation or attack data generation." }, { "id": "backtest_reports", "group": "Testing", "name": "Backtest reports", "definition": "A test run produces a saved report (hit counts, false positives, volume) that can be reviewed.", "proof": "A docs page describing a persisted result or report from testing a rule." }, { "id": "test_coverage_reporting", "group": "Testing", "name": "Test coverage reporting", "definition": "The platform reports which detections have tests or have been validated.", "proof": "A docs page describing validation or test coverage status across the rule set." }, { "id": "attack_mapping", "group": "Coverage analytics", "name": "ATT&CK mapping per rule", "definition": "Each rule carries MITRE ATT&CK tactic and technique tags.", "proof": "A docs page stating rules are mapped or tagged to ATT&CK." }, { "id": "attack_gap_view", "group": "Coverage analytics", "name": "Gap view against ATT&CK", "definition": "A view shows which ATT&CK techniques have no active detection.", "proof": "A docs page describing a coverage matrix or gap report." }, { "id": "data_source_coverage", "group": "Coverage analytics", "name": "Data source coverage view", "definition": "A view shows which data sources feed detections or which are missing for coverage.", "proof": "A docs page describing data source or log source coverage against detections." }, { "id": "log_source_health_rules", "group": "Coverage analytics", "name": "Log source health tied to rules", "definition": "Log source health problems are linked to the rules that depend on them.", "proof": "A docs page connecting ingestion or source health to detection rules." }, { "id": "noisy_rule_detection", "group": "Rule health", "name": "Noisy rule detection", "definition": "The platform identifies rules that produce excess or low-value alerts.", "proof": "A docs page describing noisy or high-volume rule identification or tuning guidance." }, { "id": "broken_silent_rule_detection", "group": "Rule health", "name": "Broken or silent rule detection", "definition": "The platform flags rules that fail, error, or stop producing results.", "proof": "A docs page describing rule errors, failed runs or silent rule detection." }, { "id": "schema_drift_alerts", "group": "Rule health", "name": "Schema or field drift alerts", "definition": "The platform alerts when fields a rule relies on change or disappear.", "proof": "A docs page describing field drift, mapping change or schema change alerts tied to rules." }, { "id": "rule_performance_cost", "group": "Rule health", "name": "Rule performance or cost telemetry", "definition": "The platform reports runtime, resource use or cost per rule.", "proof": "A docs page describing per-rule execution time, latency or resource metrics." }, { "id": "lifecycle_states", "group": "Rule health", "name": "Deprecation and lifecycle states", "definition": "Rules carry states such as active, test, deprecated, with documented handling.", "proof": "A docs page describing rule status values or deprecation handling." }, { "id": "vendor_library_count", "group": "Library", "name": "Vendor-maintained library with published count", "definition": "The vendor maintains a rule library and states how many rules it holds.", "proof": "A vendor page stating a count of library rules." }, { "id": "community_library", "group": "Library", "name": "Community library", "definition": "A public library accepts or contains community-contributed rules.", "proof": "A repo or docs page with a contribution guide or community rule folder." }, { "id": "update_cadence", "group": "Library", "name": "Update cadence published", "definition": "The vendor states how often library content is updated.", "proof": "A docs or product page stating a release cadence or recent version history." } ], "rubric": { "version": "1.0", "weights": { "languages": 15, "git_ci": 18, "testing": 15, "coverage": 12, "rule_health": 18, "versioning": 8, "library": 8, "pricing": 6 }, "criteria": [ { "key": "languages", "label": "Rule languages and conversion paths", "weight": 15 }, { "key": "git_ci", "label": "Git-native workflow and CI/CD", "weight": 18 }, { "key": "testing", "label": "Testing", "weight": 15 }, { "key": "coverage", "label": "Coverage analytics", "weight": 12 }, { "key": "rule_health", "label": "Rule health", "weight": 18 }, { "key": "versioning", "label": "Versioning and rollback", "weight": 8 }, { "key": "library", "label": "Content library size and freshness", "weight": 8 }, { "key": "pricing", "label": "Pricing transparency", "weight": 6 } ] }, "platforms": [ { "slug": "panther", "name": "Panther", "profiled": true, "rubric_total": 6.31, "rubric_parts": { "languages": 1.2, "git_ci": 1.62, "testing": 1.2, "coverage": 0.6, "rule_health": 0.63, "versioning": 0.48, "library": 0.4, "pricing": 0.18 }, "rubric_criteria": { "languages": { "status": "documented", "score": 8, "reason": "Detections are Python (rules, scheduled rules, correlation rules); Sigma rules can be converted into Panther rules, per the detections docs.", "vendor_claim": false, "sources": [ { "url": "https://docs.panther.com/detections", "read": "2026-11-04" } ] }, "git_ci": { "status": "documented", "score": 9, "reason": "panther_analysis_tool runs lint and test in a GitHub Actions workflow, deploys with CircleCI or GitHub Actions, and uploads with an API token; fork-and-pull flow for upstream content is documented.", "vendor_claim": false, "sources": [ { "url": "https://github.com/panther-labs/panther-analysis", "read": "2026-11-04" }, { "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd", "read": "2026-11-04" } ] }, "testing": { "status": "documented", "score": 8, "reason": "Unit test inputs per detection run with 'panther_analysis_tool test', filterable by path, severity or log type; no historical replay documented.", "vendor_claim": false, "sources": [ { "url": "https://docs.panther.com/detections", "read": "2026-11-04" }, { "url": "https://github.com/panther-labs/panther-analysis", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 5, "reason": "Framework Mapping tags detections to MITRE ATT&CK; the docs read describe no coverage matrix or gap view.", "vendor_claim": false, "sources": [ { "url": "https://docs.panther.com/detections", "read": "2026-11-04" } ] }, "rule_health": { "status": "not_documented", "score": 3.5, "reason": "The detections docs page does not cover detection metrics, noise metrics or rule-failure monitoring; the home page publishes no detection health data.", "vendor_claim": false, "sources": [ { "url": "https://docs.panther.com/detections", "read": "2026-11-04" }, { "url": "https://panther.com/", "read": "2026-11-04" } ] }, "versioning": { "status": "partial", "score": 6, "reason": "Content lives in git, but the detections docs page does not describe version history or rollback inside the product.", "vendor_claim": false, "sources": [ { "url": "https://docs.panther.com/detections", "read": "2026-11-04" }, { "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd", "read": "2026-11-04" } ] }, "library": { "status": "partial", "score": 5, "reason": "panther-analysis is Apache 2.0 with built-in Python detections; neither the repo nor the home page gives a count.", "vendor_claim": false, "sources": [ { "url": "https://github.com/panther-labs/panther-analysis", "read": "2026-11-04" }, { "url": "https://panther.com/", "read": "2026-11-04" } ] }, "pricing": { "status": "not_documented", "score": 3, "reason": "The pricing page states no model, unit or price.", "vendor_claim": false, "sources": [ { "url": "https://panther.com/pricing", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 18, "maturity_max": 33, "maturity_core_30": 16, "counts": { "documented": 14, "partial": 8, "not_documented": 11 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "sigma_conversion": { "status": "documented", "note": "'Converting Sigma Rules': sigma-cli converts Sigma rules to Panther Simple or Python detections", "url": "https://docs.panther.com/panther-developer-workflows/converting-sigma-rules", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "python_detections": { "status": "documented", "note": "'Writing Python Detections'; rules, policies and scheduled rules", "url": "https://docs.panther.com/detections/rules/python", "read": "2026-11-03" }, "visual_builder": { "status": "documented", "note": "'Using the Simple Detection Builder' and 'AI Detection Builder (Beta)' in the Console", "url": "https://docs.panther.com/detections/rules/simple-detection-builder", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "lucene_kql_like": { "status": "partial", "note": "'PantherFlow (Beta)' is a pipelined query language for search; detection use not confirmed", "url": "https://docs.panther.com/pantherflow", "read": "2026-11-03" }, "git_sync": { "status": "documented", "note": "'Using panther-analysis' repo setup and 'Setting Up the Panther GitHub App (Beta)'", "url": "https://docs.panther.com/panther-developer-workflows/detections-repo", "read": "2026-11-03" }, "pr_deployment": { "status": "documented", "note": "'Managing Panther Content via GitHub Actions': automate testing and upload from the repo to the Console", "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd/deployment-workflows/github-actions", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "documented", "note": "Panther Analysis Tool commands test, validate, zip, upload, delete", "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/pat", "read": "2026-11-03" }, "api_rule_crud": { "status": "documented", "note": "PAT upload and delete use the Panther API; API token required in the CI workflow", "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/pat", "read": "2026-11-03" }, "ci_examples": { "status": "documented", "note": "Workflow YAML for GitHub Actions and CircleCI; no GitLab CI page in the docs index", "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd/deployment-workflows/github-actions", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "No staging or environment promotion flow found in the CI/CD pages read", "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/ci-cd/migrating-to-a-ci-cd-workflow", "read": "2026-11-03" }, "unit_tests": { "status": "documented", "note": "'Testing': unit tests with test events and expected alert outcome; Panther sets no minimum number of tests", "url": "https://docs.panther.com/detections/testing", "read": "2026-11-03" }, "replay_historical": { "status": "documented", "note": "'Data Replay (Beta)': test rules against historical log data before enabling", "url": "https://docs.panther.com/detections/testing/data-replay", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "backtest_reports": { "status": "partial", "note": "Data Replay previews a rule's outcome on real data; saved report not described", "url": "https://docs.panther.com/detections/testing/data-replay", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "'Framework Mapping and MITRE ATT&CK Matrix': map detections to ATT&CK", "url": "https://docs.panther.com/detections/report-mapping", "read": "2026-11-03" }, "attack_gap_view": { "status": "documented", "note": "MITRE ATT&CK tab on the Dashboard shows Covered, Partially Covered, Not Relevant per technique", "url": "https://docs.panther.com/detections/report-mapping", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "ATT&CK matrix coverage states reference onboarded log sources; no separate source coverage view", "url": "https://docs.panther.com/detections/report-mapping", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "'Monitoring Log Sources' shows unhealthy sources and drop-off alarms; not linked to the rules that use them", "url": "https://docs.panther.com/data-onboarding/monitoring-log-sources", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "documented", "note": "'Rule errors and scheduled rule errors' raised when detection code raises or a scheduled rule runs over 15 seconds", "url": "https://docs.panther.com/detections/rules", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "partial", "note": "System Errors include 'Log Classification Errors' for logs that fail schemas; not tied to rule fields", "url": "https://docs.panther.com/system-configuration/notifications/system-errors", "read": "2026-11-03" }, "rule_performance_cost": { "status": "partial", "note": "PAT 'benchmark' performance-tests one rule against a log type before deploy; no runtime telemetry described", "url": "https://docs.panther.com/panther-developer-workflows/detections-repo/pat", "read": "2026-11-03" }, "lifecycle_states": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.panther.com/detections", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'Using Panther-managed Detections' describes out-of-the-box Python detections; no count on page", "url": "https://docs.panther.com/detections/panther-managed", "read": "2026-11-03" }, "community_library": { "status": "documented", "note": "panther-analysis README: all detections developed by the Panther Team and the Community, contributing guidelines", "url": "https://raw.githubusercontent.com/panther-labs/panther-analysis/develop/README.md", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "Panther 'periodically releases improvements' to managed detections; Content Catalog (Beta) updates; no cadence", "url": "https://docs.panther.com/detections/panther-managed", "read": "2026-11-03" } } } }, { "slug": "elastic-security", "name": "Elastic Security", "profiled": true, "rubric_total": 7.6, "rubric_parts": { "languages": 1.05, "git_ci": 1.44, "testing": 1.05, "coverage": 0.6, "rule_health": 1.62, "versioning": 0.64, "library": 0.72, "pricing": 0.48 }, "rubric_criteria": { "languages": { "status": "partial", "score": 7, "reason": "The repo and docs show ES|QL and TOML rule files with a CLI; the rule-type page read did not list KQL, EQL or Lucene and Sigma conversion is not in the README.", "vendor_claim": false, "sources": [ { "url": "https://www.elastic.co/docs/explore-analyze/query-filter/languages/esql", "read": "2026-11-03" }, { "url": "https://github.com/elastic/detection-rules", "read": "2026-11-04" }, { "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/manage-detection-rules", "read": "2026-11-04" } ] }, "git_ci": { "status": "documented", "score": 8, "reason": "detection-rules CLI has create-rule, test, validate-all, import-rules-to-repo and export-rules-from-repo, with a DaC reference guide and a Kibana API wrapper; README describes no CI workflow itself.", "vendor_claim": false, "sources": [ { "url": "https://github.com/elastic/detection-rules", "read": "2026-11-04" }, { "url": "https://www.elastic.co/blog/detections-as-code-elastic-security", "read": "2026-11-03" } ] }, "testing": { "status": "partial", "score": 7, "reason": "The 'test' command runs unit tests over rules and the blog describes configurable unit tests; manual runs over a chosen time range exist, but no replay against stored data is documented as a test step.", "vendor_claim": false, "sources": [ { "url": "https://github.com/elastic/detection-rules", "read": "2026-11-04" }, { "url": "https://www.elastic.co/blog/detections-as-code-elastic-security", "read": "2026-11-03" }, { "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/manage-detection-rules", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 5, "reason": "Rules list filters by ATT&CK tactic and technique and the repo links a Navigator coverage badge; no in-product coverage matrix or gap view documented.", "vendor_claim": false, "sources": [ { "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/manage-detection-rules", "read": "2026-11-04" }, { "url": "https://github.com/elastic/detection-rules", "read": "2026-11-04" } ] }, "rule_health": { "status": "documented", "score": 9, "reason": "Rule Monitoring tab shows failures, execution time, gaps and a duration breakdown with a monitoring dashboard, and a monthly pipeline scores prebuilt rules for Noise, Performance and Threat over 30 days.", "vendor_claim": false, "sources": [ { "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/monitor-rule-executions", "read": "2026-11-04" }, { "url": "https://www.elastic.co/security-labs/blog/elastic-siem-detection-rule-tags", "read": "2026-11-03" } ] }, "versioning": { "status": "documented", "score": 8, "reason": "A History view (Elastic Stack 9.5+) shows a timeline, compares revisions and restores earlier states; rules are also TOML in git.", "vendor_claim": false, "sources": [ { "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/manage-detection-rules", "read": "2026-11-04" }, { "url": "https://github.com/elastic/detection-rules", "read": "2026-11-04" } ] }, "library": { "status": "documented", "score": 9, "reason": "1,781 prebuilt rules were in scope of the monthly scoring post; the security page separately says over 1,300, so the count depends on the page.", "vendor_claim": false, "sources": [ { "url": "https://www.elastic.co/security-labs/blog/elastic-siem-detection-rule-tags", "read": "2026-11-03" } ] }, "pricing": { "status": "documented", "score": 8, "reason": "Serverless pricing page publishes ingest and retention rates and add-ons; no trial length stated.", "vendor_claim": false, "sources": [ { "url": "https://www.elastic.co/pricing/serverless-security", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 16.5, "maturity_max": 33, "maturity_core_30": 15, "counts": { "documented": 11, "partial": 11, "not_documented": 11 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "No Sigma rule type on the rule-types page; Sigma not named on pages read", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/rule-types", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "eql_esql": { "status": "documented", "note": "Rule types 'Event correlation (EQL)' and 'ES|QL'", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/rule-types", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "lucene_kql_like": { "status": "documented", "note": "'Custom query' rules match events using KQL or Lucene", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/choose-the-right-rule-type", "read": "2026-11-03" }, "git_sync": { "status": "documented", "note": "DaC reference: 'Git Sync' between local repo and the VCS, using the detection-rules repo", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "pr_deployment": { "status": "partial", "note": "DaC reference describes 'CI/CD Sync via APIs' and peer review practice; no PR-triggered deploy workflow shipped on pages read", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "documented", "note": "detection_rules CLI: validate-rule, validate-all, kibana import-rules, export-rules", "url": "https://raw.githubusercontent.com/elastic/detection-rules/main/CLI.md", "read": "2026-11-03" }, "api_rule_crud": { "status": "documented", "note": "DaC reference: export with the Detection Engine API; kibana import-rules loads rules into Kibana", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "ci_examples": { "status": "partial", "note": "Repo runs its own 'Unit Tests' GitHub Actions workflow; DaC reference says CI/CD pipeline is optional and gives no customer workflow YAML on pages read", "url": "https://raw.githubusercontent.com/elastic/detection-rules/main/README.md", "read": "2026-11-03" }, "env_promotion": { "status": "partial", "note": "DaC reference lists 'Pre-Production Testing' and 'Managing multiple rule sets'; no dev/staging/prod promotion flow described", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "unit_tests": { "status": "documented", "note": "'Unit testing' sub-component: Python unit tests for rules in the detection-rules repo", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "replay_historical": { "status": "documented", "note": "'Run rules manually' over a specified past time range, tracked in the Manual runs table", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/manage-detection-rules", "read": "2026-11-03" }, "synthetic_events": { "status": "partial", "note": "README lists an 'RTAs' (red team automation) section; generation of test events not described on pages read", "url": "https://raw.githubusercontent.com/elastic/detection-rules/main/README.md", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "'MITRE ATT&CK coverage' page; custom rules mapped in Advanced settings; threat field in TOML", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/mitre-attack-coverage", "read": "2026-11-03" }, "attack_gap_view": { "status": "documented", "note": "'MITRE ATT&CK coverage' page: 'Identifying coverage gaps' via light or empty cells", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/mitre-attack-coverage", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "'Data Quality dashboard' checks ECS mapping of indices; not a view of detection coverage per source", "url": "https://www.elastic.co/docs/solutions/security/dashboards/data-quality-dashboard", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "Rule execution warning when a rule's index pattern is not found; no per-source health tied to rules", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/monitor-rule-executions", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://dac-reference.readthedocs.io/en/latest/dac_concept_and_workflows.html", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "documented", "note": "'Rule execution status' (succeeded, failed, warning), 'Rule Monitoring' tab, gap duration, 'Fill rule execution gaps'", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/monitor-rule-executions", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "partial", "note": "'Data Quality dashboard' flags 'unsuccessful mappings' to ECS in indices; no alert tied to rule fields", "url": "https://www.elastic.co/docs/solutions/security/dashboards/data-quality-dashboard", "read": "2026-11-03" }, "rule_performance_cost": { "status": "documented", "note": "'Execution results' tab shows execution duration; 'Detection rule monitoring dashboard' for performance metrics", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/monitor-rule-executions", "read": "2026-11-03" }, "lifecycle_states": { "status": "partial", "note": "'Handle deprecated prebuilt rules' on the Rules page; no lifecycle states for custom rules on pages read", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/monitor-rule-executions", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'Prebuilt detection rules reference' lists every prebuilt rule; page states no total", "url": "https://www.elastic.co/docs/reference/security/prebuilt-rules", "read": "2026-11-03" }, "community_library": { "status": "partial", "note": "detection-rules README has 'How to contribute'; repo is Elastic's own rule set", "url": "https://raw.githubusercontent.com/elastic/detection-rules/main/README.md", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "'Elastic regularly updates prebuilt rules'; no cadence stated", "url": "https://www.elastic.co/docs/solutions/security/detect-and-alert/update-prebuilt-rules", "read": "2026-11-03" } } } }, { "slug": "google-secops", "name": "Google Security Operations", "profiled": true, "rubric_total": 6.83, "rubric_parts": { "languages": 1.05, "git_ci": 1.44, "testing": 1.2, "coverage": 0.48, "rule_health": 1.44, "versioning": 0.64, "library": 0.4, "pricing": 0.18 }, "rubric_criteria": { "languages": { "status": "partial", "score": 7, "reason": "YARA-L 2.0 is documented in depth (meta, events, match, outcome, condition); the examples page names no other rule language and no Sigma conversion path.", "vendor_claim": false, "sources": [ { "url": "https://docs.cloud.google.com/chronicle/docs/detection/yara-l-2-0-overview", "read": "2026-11-03" } ] }, "git_ci": { "status": "documented", "score": 8, "reason": "Rules API (create, patch, list, revisions) plus a Content Manager CLI in the community repo; a Google community post describes a scheduled GitHub Actions workflow committing .yaral files. The main detection-as-code docs page returned 404.", "vendor_claim": false, "sources": [ { "url": "https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules", "read": "2026-11-04" }, { "url": "https://github.com/chronicle/detection-rules", "read": "2026-11-04" }, { "url": "https://security.googlecloudcommunity.com/community-blog-42/getting-started-with-detection-as-code-and-google-secops-part-1-of-2-3885", "read": "2026-11-03" } ] }, "testing": { "status": "documented", "score": 8, "reason": "Retrohunt runs a rule against historical logs and the Content Manager CLI has test and verify commands; part 2 of the community post on testing was not read.", "vendor_claim": false, "sources": [ { "url": "https://docs.cloud.google.com/chronicle/docs/detection/view-all-rules", "read": "2026-11-04" }, { "url": "https://security.googlecloudcommunity.com/community-blog-42/getting-started-with-detection-as-code-and-google-secops-part-1-of-2-3885", "read": "2026-11-03" } ] }, "coverage": { "status": "not_documented", "score": 4, "reason": "No ATT&CK coverage view was read in this session.", "vendor_claim": false, "sources": [ { "url": "https://docs.cloud.google.com/chronicle/docs/detection/view-all-rules", "read": "2026-11-04" } ] }, "rule_health": { "status": "documented", "score": 8, "reason": "Rules show Enabled or Disabled, Limited or Paused states, rules capacity and a Detections Health Dashboard, with per-rule daily counts and a four-week trend.", "vendor_claim": false, "sources": [ { "url": "https://docs.cloud.google.com/chronicle/docs/detection/view-all-rules", "read": "2026-11-04" }, { "url": "https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules", "read": "2026-11-04" } ] }, "versioning": { "status": "documented", "score": 8, "reason": "A new revision is created whenever rule text changes, with listRevisions and etag concurrency control.", "vendor_claim": false, "sources": [ { "url": "https://docs.cloud.google.com/chronicle/docs/reference/rest/v1alpha/projects.locations.instances.rules", "read": "2026-11-04" } ] }, "library": { "status": "partial", "score": 5, "reason": "Community repo gives no rule count and curated detections were not read.", "vendor_claim": false, "sources": [ { "url": "https://github.com/chronicle/detection-rules", "read": "2026-11-04" } ] }, "pricing": { "status": "not_documented", "score": 3, "reason": "Pricing pages returned 404 on both paths tried.", "vendor_claim": false, "sources": [ { "url": "https://cloud.google.com/chronicle/pricing", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 15, "maturity_max": 33, "maturity_core_30": 13, "counts": { "documented": 11, "partial": 8, "not_documented": 14 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "yara_l": { "status": "documented", "note": "'Rules Editor' for YARA-L 2.0 rules; 'Generate YARA-L with Gemini'", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "git_sync": { "status": "documented", "note": "chronicle/detection-rules README: 'rule manager' tool for a Detection-as-Code pipeline via the REST API", "url": "https://raw.githubusercontent.com/chronicle/detection-rules/main/README.md", "read": "2026-11-03" }, "pr_deployment": { "status": "partial", "note": "README describes a DaC pipeline for rules; no pull request trigger described", "url": "https://raw.githubusercontent.com/chronicle/detection-rules/main/README.md", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "documented", "note": "README: tools/content_manager is a 'CLI tool used to manage rules and other content' via the REST API", "url": "https://raw.githubusercontent.com/chronicle/detection-rules/main/README.md", "read": "2026-11-03" }, "api_rule_crud": { "status": "documented", "note": "'Rules API' and Unified Rules API: search, list, batch modify live, alerting and archive states", "url": "https://docs.cloud.google.com/chronicle/docs/detection/unified-rules/unified-rules-api", "read": "2026-11-03" }, "ci_examples": { "status": "not documented", "note": "README gives no workflow YAML; Terraform registry page for chronicle_rule was not readable as static HTML", "url": "https://raw.githubusercontent.com/chronicle/detection-rules/main/README.md", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "No dev, staging and prod promotion flow on pages read", "url": "https://raw.githubusercontent.com/chronicle/detection-rules/main/README.md", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "replay_historical": { "status": "documented", "note": "'Test rule' over a time range and 'Retrohunt' on historical data", "url": "https://docs.cloud.google.com/chronicle/docs/detection/run-rule-historical-data", "read": "2026-11-03" }, "synthetic_events": { "status": "partial", "note": "'Event simulation' delivers realistic threat sequences into ingestion; pre-GA feature", "url": "https://docs.cloud.google.com/chronicle/docs/secops/event-simulation", "read": "2026-11-03" }, "backtest_reports": { "status": "partial", "note": "'Test rule results' window; results are not saved and are not shown in the Rules dashboard", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "'Monitor threat coverage (MITRE)' maps detections to tactics and techniques", "url": "https://docs.cloud.google.com/chronicle/docs/detection/mitre-dashboard", "read": "2026-11-03" }, "attack_gap_view": { "status": "documented", "note": "MITRE dashboard 'helps you find gaps in your threat coverage'", "url": "https://docs.cloud.google.com/chronicle/docs/detection/mitre-dashboard", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "'Ingestion metrics overview' and dashboards; not a coverage-versus-rules view", "url": "https://docs.cloud.google.com/chronicle/docs/ingestion/understand-ingestion-metrics", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "'Monitor rule performance' attributes detection delay to late ingestion or parsing; no per-rule source health link", "url": "https://docs.cloud.google.com/chronicle/docs/detection/rule-effectiveness", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "partial", "note": "Rule Observability dashboard shows detection count; 'tuning the rule with additional Rule exclusions'", "url": "https://docs.cloud.google.com/chronicle/docs/detection/rule-effectiveness", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "documented", "note": "'Rule errors': compilation and runtime errors during test, live run and retrohunt; Rules dashboard", "url": "https://docs.cloud.google.com/chronicle/docs/detection/rule-errors", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.cloud.google.com/chronicle/docs/detection/manage-all-rules", "read": "2026-11-03" }, "rule_performance_cost": { "status": "documented", "note": "'Monitor rule performance': Rule Observability dashboard, latencyMetrics, quotas on rule count and complexity", "url": "https://docs.cloud.google.com/chronicle/docs/detection/rule-effectiveness", "read": "2026-11-03" }, "lifecycle_states": { "status": "documented", "note": "Live rule and alerting states, 'Archive rules', 'View rule versions'", "url": "https://docs.cloud.google.com/chronicle/docs/detection/view-rule-versions", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'Curated detections' rule sets by category; page read gives no total", "url": "https://docs.cloud.google.com/chronicle/docs/detection/curated-detections", "read": "2026-11-03" }, "community_library": { "status": "documented", "note": "chronicle/detection-rules repo: rules/community holds 'YARA-L rules created by members of the Google SecOps team and user community'", "url": "https://raw.githubusercontent.com/chronicle/detection-rules/main/README.md", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "Curated rule sets and new rules in existing sets update automatically; no cadence stated", "url": "https://docs.cloud.google.com/chronicle/docs/detection/curated-detections", "read": "2026-11-03" } } } }, { "slug": "splunk-enterprise-security", "name": "Splunk Enterprise Security (Cisco)", "profiled": true, "rubric_total": 6.21, "rubric_parts": { "languages": 0.9, "git_ci": 1.26, "testing": 1.2, "coverage": 0.72, "rule_health": 0.63, "versioning": 0.48, "library": 0.72, "pricing": 0.3 }, "rubric_criteria": { "languages": { "status": "partial", "score": 6, "reason": "SPL detections as YAML content built by contentctl; SnapAttack translation into ES was announced in 2024; the pages read do not list other languages or Sigma conversion.", "vendor_claim": false, "sources": [ { "url": "https://github.com/splunk/contentctl", "read": "2026-11-04" }, { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "git_ci": { "status": "partial", "score": 7, "reason": "contentctl documents sample GitHub Actions workflows, but its README says development is moving to Detection Studio and the repo no longer takes pull requests.", "vendor_claim": false, "sources": [ { "url": "https://github.com/splunk/contentctl", "read": "2026-11-04" } ] }, "testing": { "status": "documented", "score": 8, "reason": "contentctl validates content in a live Splunk instance, and research.splunk.com says each detection is tested against real attack data (vendor claim).", "vendor_claim": true, "sources": [ { "url": "https://github.com/splunk/contentctl", "read": "2026-11-04" }, { "url": "https://research.splunk.com/", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 6, "reason": "Each detection is mapped to ATT&CK on research.splunk.com; its coverage figures showed placeholder dashes on read and no in-product gap view was read.", "vendor_claim": true, "sources": [ { "url": "https://research.splunk.com/", "read": "2026-11-04" } ] }, "rule_health": { "status": "not_documented", "score": 3.5, "reason": "No rule health, noisy-rule or search-skipped monitoring page could be read; the ES 8 admin page returned 404.", "vendor_claim": false, "sources": [ { "url": "https://research.splunk.com/", "read": "2026-11-04" } ] }, "versioning": { "status": "partial", "score": 6, "reason": "Content is in git with ESCU releases (v6.9.2 shown); in-product version history and rollback were not read.", "vendor_claim": false, "sources": [ { "url": "https://research.splunk.com/", "read": "2026-11-04" }, { "url": "https://github.com/splunk/security_content", "read": "2026-11-03" } ] }, "library": { "status": "documented", "score": 9, "reason": "research.splunk.com reports 2,207 detections, 367 analytic stories and 86 playbooks, undated; newest detection entry seen was dated 2026-10-28.", "vendor_claim": false, "sources": [ { "url": "https://research.splunk.com/", "read": "2026-11-04" } ] }, "pricing": { "status": "partial", "score": 5, "reason": "Activity-based, workload or ingest models are named; no amounts are published and every edition routes to a quote.", "vendor_claim": false, "sources": [ { "url": "https://www.splunk.com/en_us/products/pricing.html", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 13.5, "maturity_max": 33, "maturity_core_30": 12, "counts": { "documented": 10, "partial": 7, "not_documented": 16 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "SigmaHQ is listed as a source of starting rules; no converter documented", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "spl": { "status": "documented", "note": "Detections are 'scheduled correlation searches' in SPL; ESCU ships 'Splunk searches'", "url": "https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.1/detections/use-detections-to-search-for-threats-in-splunk-enterprise-security", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "git_sync": { "status": "documented", "note": "contentctl keeps content as YAML in a repo (security_content layout) and packages it into an app", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "pr_deployment": { "status": "partial", "note": "Sample workflows build and unit-test on pull_request; loading into a Splunk environment is a manual step", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/docs/Sample_CICD_Templates.md", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "documented", "note": "contentctl init, new, validate, build, test; ecosystem table: 'Generate, validate, build, test, and deploy'", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/docs/UserGuide.md", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "REST API for saved searches or detections not read on pages checked", "url": "https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.1/detections/use-detections-to-search-for-threats-in-splunk-enterprise-security", "read": "2026-11-03" }, "ci_examples": { "status": "documented", "note": "'Sample CICD Workflows': GitHub Actions build and unit-testing YAML; no GitLab example", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/docs/Sample_CICD_Templates.md", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "contentctl test targets Docker containers or a preconfigured Splunk server; no promotion flow", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/docs/ContentTestingGuide.md", "read": "2026-11-03" }, "unit_tests": { "status": "documented", "note": "'Content Testing Guide': contentctl test runs detections against attack_data in a real Splunk instance", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/docs/ContentTestingGuide.md", "read": "2026-11-03" }, "replay_historical": { "status": "partial", "note": "contentctl test replays Splunk Attack Data datasets; replay of a customer's historical data not described", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/docs/ContentTestingGuide.md", "read": "2026-11-03" }, "synthetic_events": { "status": "documented", "note": "Splunk Attack Range and Attack Data, Atomic Red Team listed in the contentctl ecosystem table", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "backtest_reports": { "status": "partial", "note": "Detection Studio product page says engineers 'test, deploy, and monitor'; no saved backtest report described", "url": "https://www.splunk.com/en_us/products/detection-studio.html", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "research.splunk.com: each detection is mapped to MITRE ATT&CK", "url": "https://research.splunk.com/", "read": "2026-11-03" }, "attack_gap_view": { "status": "partial", "note": "Detection Studio product page: 'Map coverage and technical gaps' against ATT&CK (product page, not reference docs)", "url": "https://www.splunk.com/en_us/products/detection-studio.html", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "Detection Studio product page: 'Identify data source gaps'; use case library shows sourcetype and data model status", "url": "https://www.splunk.com/en_us/products/detection-studio.html", "read": "2026-11-03" }, "log_source_health_rules": { "status": "documented", "note": "Use case library shows status icons for the sourcetypes and data models each detection search uses", "url": "https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.1/managing-security-content/manage-analytic-stories-through-the-use-case-library-in-splunk-enterprise-security", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "partial", "note": "Detection Studio product page: 'Analyze detection health'; mechanics not described", "url": "https://www.splunk.com/en_us/products/detection-studio.html", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "lifecycle_states": { "status": "documented", "note": "'Use detection versioning in Splunk Enterprise Security'; review and deprecate detections; contentctl status production, experimental, deprecated", "url": "https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.1/detections/use-detections-to-search-for-threats-in-splunk-enterprise-security", "read": "2026-11-03" }, "vendor_library_count": { "status": "documented", "note": "research.splunk.com states 2207 detections and over 2,000 production-ready detections", "url": "https://research.splunk.com/", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "security_content is written by the Splunk Threat Research Team; contentctl repo no longer accepts pull requests", "url": "https://raw.githubusercontent.com/splunk/contentctl/main/README.md", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "research.splunk.com shows 'Latest Update: v6.9.2'; ESCU update dialog in ES; no cadence stated", "url": "https://research.splunk.com/", "read": "2026-11-03" } } } }, { "slug": "microsoft-sentinel", "name": "Microsoft Sentinel", "profiled": true, "rubric_total": 7.81, "rubric_parts": { "languages": 1.05, "git_ci": 1.62, "testing": 0.9, "coverage": 0.96, "rule_health": 1.62, "versioning": 0.64, "library": 0.48, "pricing": 0.54 }, "rubric_criteria": { "languages": { "status": "partial", "score": 7, "reason": "KQL is the single analytics language; rule content deploys as Bicep or ARM, with a PowerShell script to convert public YAML rules; no Sigma path read.", "vendor_claim": false, "sources": [ { "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-04" } ] }, "git_ci": { "status": "documented", "score": 9, "reason": "Repositories connect GitHub or Azure DevOps, generate a workflow, deploy only changed files (smart deployments) and cover analytics, automation and custom detection rules (preview), with an API; limit of five connections per workspace.", "vendor_claim": false, "sources": [ { "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd", "read": "2026-11-04" }, { "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-04" } ] }, "testing": { "status": "partial", "score": 6, "reason": "Manual rerun of analytics rules is documented for testing and tuning; no unit tests or pipeline test step in the repositories docs.", "vendor_claim": false, "sources": [ { "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity", "read": "2026-11-04" }, { "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-04" } ] }, "coverage": { "status": "documented", "score": 8, "reason": "MITRE page shows a coverage matrix of active rules, simulated coverage from available but unconfigured rules and, in the Defender portal, the ratio against recommended detections; the page is in preview and aligned to ATT&CK v18.", "vendor_claim": false, "sources": [ { "url": "https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage", "read": "2026-11-04" } ] }, "rule_health": { "status": "documented", "score": 9, "reason": "SentinelHealth logs run status and failure reasons, SentinelAudit logs before and after changes, and a workbook plus delay queries cover retries, auto-disabled rules and skipped windows.", "vendor_claim": false, "sources": [ { "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity", "read": "2026-11-04" } ] }, "versioning": { "status": "documented", "score": 8, "reason": "Repository is the single source of truth, and SentinelAudit records who changed which property from which value; rollback is a git revert rather than a product feature.", "vendor_claim": false, "sources": [ { "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-04" }, { "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity", "read": "2026-11-04" } ] }, "library": { "status": "partial", "score": 6, "reason": "Content hub and a public MIT repo hold built-in rules; no dated rule count was read.", "vendor_claim": false, "sources": [ { "url": "https://github.com/Azure/Azure-Sentinel", "read": "2026-11-03" } ] }, "pricing": { "status": "documented", "score": 9, "reason": "Per-GB pay-as-you-go and commitment tiers from 100 to 50,000 GB a day are published, with separate data lake rates.", "vendor_claim": false, "sources": [ { "url": "https://www.microsoft.com/en-us/security/pricing/microsoft-sentinel/", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 12.5, "maturity_max": 33, "maturity_core_30": 11, "counts": { "documented": 10, "partial": 5, "not_documented": 18 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "kql": { "status": "documented", "note": "Analytics rules are KQL queries ('Build and test your queries in the Logs screen')", "url": "https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "git_sync": { "status": "documented", "note": "'Repositories': connect a workspace to GitHub or Azure DevOps; content deploys from the repo", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd", "read": "2026-11-03" }, "pr_deployment": { "status": "documented", "note": "Repository connection deploys updated analytics rules, hunting queries, parsers, playbooks automatically on repo change", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "No Sentinel-specific validate and deploy CLI on pages read", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "api_rule_crud": { "status": "documented", "note": "Alert Rules REST API: Create Or Update, Delete, Get, List", "url": "https://learn.microsoft.com/en-us/rest/api/securityinsights/alert-rules?view=rest-securityinsights-2025-09-01", "read": "2026-11-03" }, "ci_examples": { "status": "documented", "note": "Repository connection creates the GitHub workflow or Azure DevOps pipeline; docs set workflow permissions", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "env_promotion": { "status": "partial", "note": "Connections map repo content to workspaces and 'smart deployments' track changes; no staged dev to prod flow described", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "replay_historical": { "status": "documented", "note": "'Manual rerun' of analytics rules and 'Results simulation: Test with current data'", "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "Analytics rule MITRE ATT&CK field; 'View MITRE ATT&CK coverage'", "url": "https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage", "read": "2026-11-03" }, "attack_gap_view": { "status": "documented", "note": "MITRE ATT&CK page with recommended coverage ratio of active detections to available templates", "url": "https://learn.microsoft.com/en-us/azure/sentinel/mitre-coverage", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "'Monitor the health of your data connectors'; no coverage-versus-detections view on pages read", "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-data-connector-health", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "SentinelHealth covers connectors and rules separately; no link between them stated", "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-data-connector-health", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "documented", "note": "'SentinelHealth' table: rule runs succeeded or failed and why; query for 'auto-disabled scheduled analytics rules'", "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "rule_performance_cost": { "status": "partial", "note": "Health log records events captured and retry delay per run; no cost or resource telemetry", "url": "https://learn.microsoft.com/en-us/azure/sentinel/monitor-analytics-rule-integrity", "read": "2026-11-03" }, "lifecycle_states": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'Content hub' solutions and standalone items; page states no total", "url": "https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions-deploy", "read": "2026-11-03" }, "community_library": { "status": "documented", "note": "Content hub: standalone items and solutions that community members can create and share", "url": "https://learn.microsoft.com/en-us/azure/sentinel/sentinel-solutions", "read": "2026-11-03" }, "update_cadence": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content", "read": "2026-11-03" } } } }, { "slug": "sigma-pysigma", "name": "Sigma and pySigma", "profiled": true, "rubric_total": 5.5, "rubric_parts": { "languages": 1.275, "git_ci": 1.08, "testing": 0.6, "coverage": 0.6, "rule_health": 0.36, "versioning": 0.4, "library": 0.64, "pricing": 0.54 }, "rubric_criteria": { "languages": { "status": "documented", "score": 8.5, "reason": "Sigma is the rule format; pySigma and sigma-cli convert it to backend queries through installable plugins (Splunk, Panther, NetWitness and others named; no total published). Scored as tooling, not a vendor.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma", "read": "2026-11-03" }, { "url": "https://github.com/SigmaHQ/pySigma", "read": "2026-11-03" }, { "url": "https://github.com/SigmaHQ/sigma-cli", "read": "2026-11-04" } ] }, "git_ci": { "status": "partial", "score": 6, "reason": "Rules are YAML files in a public GitHub repo and sigma-cli converts from the command line; the pages read describe no CI workflow.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma", "read": "2026-11-03" }, { "url": "https://github.com/SigmaHQ/sigma-cli", "read": "2026-11-04" } ] }, "testing": { "status": "not_documented", "score": 4, "reason": "The pages read do not document rule testing, validators or replay; this scores what was read, not what the tooling may offer elsewhere.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma-cli", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 5, "reason": "Rules carry ATT&CK tags in the repository; the pages read describe no coverage matrix or gap analysis.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma", "read": "2026-11-03" } ] }, "rule_health": { "status": "not_documented", "score": 2, "reason": "No rule health, noise or field drift feature is documented; a rule format has no runtime to measure.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma", "read": "2026-11-03" }, { "url": "https://github.com/SigmaHQ/pySigma", "read": "2026-11-03" } ] }, "versioning": { "status": "partial", "score": 5, "reason": "The format is defined in a specification repository and rules live in git; no rollback tooling is described.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma", "read": "2026-11-03" } ] }, "library": { "status": "documented", "score": 8, "reason": "SigmaHQ README states more than 3,000 community rules under the Detection Rule License 1.1; no dated count.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma", "read": "2026-11-03" } ] }, "pricing": { "status": "documented", "score": 9, "reason": "Free and open source: rules under DRL 1.1, pySigma and sigma-cli under LGPL-2.1.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SigmaHQ/sigma", "read": "2026-11-03" }, { "url": "https://github.com/SigmaHQ/pySigma", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 12, "maturity_max": 33, "maturity_core_30": 9.5, "counts": { "documented": 10, "partial": 4, "not_documented": 19 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "documented", "note": "Sigma rule format and 'Sigma Rules Specification', including 'Correlations'", "url": "https://sigmahq.io/docs/meta/correlations.html", "read": "2026-11-03" }, "sigma_conversion": { "status": "documented", "note": "pySigma 'Converting Sigma Rules into Queries'; sigma-cli 'sigma convert -t splunk'", "url": "https://sigmahq-pysigma.readthedocs.io/en/latest/", "read": "2026-11-03" }, "yara_l": { "status": "partial", "note": "Google SecOps backend converts to 'UDM searches and YARA-L 2.0 detection rules'; listed with status Development", "url": "https://sigmahq.io/docs/digging-deeper/backends.html", "read": "2026-11-03" }, "spl": { "status": "documented", "note": "Splunk backend listed under Backends", "url": "https://sigmahq.io/docs/digging-deeper/backends.html", "read": "2026-11-03" }, "kql": { "status": "documented", "note": "'Kusto' backend: Kusto Query Language (KQL) backend, status Stable", "url": "https://sigmahq.io/docs/digging-deeper/backends.html", "read": "2026-11-03" }, "eql_esql": { "status": "documented", "note": "Elasticsearch backend converts to 'Lucene, ES|QL (with correlations) and EQL queries'", "url": "https://sigmahq.io/docs/digging-deeper/backends.html", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "lucene_kql_like": { "status": "documented", "note": "Elasticsearch backend outputs Lucene queries", "url": "https://sigmahq.io/docs/digging-deeper/backends.html", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "partial", "note": "sigma-cli: convert, list, plugin install; pySigma 'Validating Sigma Rules'; no deploy step", "url": "https://sigmahq-pysigma.readthedocs.io/en/latest/", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "ci_examples": { "status": "partial", "note": "Sigma repo's own GitHub Actions 'Sigma Rule Tests' (yamllint, logsource tests); not a deploy pipeline", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/.github/workflows/sigma-test.yml", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "replay_historical": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "Sigma 'tags' field carries ATT&CK tags per rule", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma-specification/main/specification/sigma-rules-specification.md", "read": "2026-11-03" }, "attack_gap_view": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "data_source_coverage": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "log_source_health_rules": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "lifecycle_states": { "status": "documented", "note": "Rule 'status': stable, test, experimental, deprecated, unsupported", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma-specification/main/specification/sigma-rules-specification.md", "read": "2026-11-03" }, "vendor_library_count": { "status": "documented", "note": "Main repo 'offers more than 3000 detection rules' (SigmaHQ is not a vendor; counted as the maintained library)", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "community_library": { "status": "documented", "note": "Community-maintained repo with contribution guide and rule types", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "'New rules are also released on a regular basis'; rule package releases on the release page", "url": "https://raw.githubusercontent.com/SigmaHQ/sigma/master/README.md", "read": "2026-11-03" } } } }, { "slug": "sekoia", "name": "Sekoia.io", "profiled": true, "rubric_total": 3.46, "rubric_parts": { "languages": 0.6, "git_ci": 0.63, "testing": 0.525, "coverage": 0.42, "rule_health": 0.54, "versioning": 0.24, "library": 0.32, "pricing": 0.18 }, "rubric_criteria": { "languages": { "status": "not_documented", "score": 4, "reason": "The community repo has a sigma_rules folder, but Sigma support on the platform is not stated on the pages read; docs.sekoia.com returned 404 on the paths tried.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SEKOIA-IO/Community", "read": "2026-11-03" }, { "url": "https://www.sekoia.com/", "read": "2026-11-03" } ] }, "git_ci": { "status": "not_documented", "score": 3.5, "reason": "No git sync, CLI or API for detections was readable.", "vendor_claim": false, "sources": [ { "url": "https://www.sekoia.com/", "read": "2026-11-03" } ] }, "testing": { "status": "not_documented", "score": 3.5, "reason": "No rule testing documented on pages read.", "vendor_claim": false, "sources": [ { "url": "https://www.sekoia.com/", "read": "2026-11-03" } ] }, "coverage": { "status": "not_documented", "score": 3.5, "reason": "No ATT&CK coverage view documented on pages read.", "vendor_claim": false, "sources": [ { "url": "https://www.sekoia.com/", "read": "2026-11-03" } ] }, "rule_health": { "status": "not_documented", "score": 3, "reason": "No rule health feature documented on pages read.", "vendor_claim": false, "sources": [ { "url": "https://www.sekoia.com/", "read": "2026-11-03" } ] }, "versioning": { "status": "not_documented", "score": 3, "reason": "Not documented on pages read.", "vendor_claim": false, "sources": [ { "url": "https://www.sekoia.com/", "read": "2026-11-03" } ] }, "library": { "status": "not_documented", "score": 4, "reason": "Public community repo holds detection rules and Sigma and YARA folders; no count given.", "vendor_claim": false, "sources": [ { "url": "https://github.com/SEKOIA-IO/Community", "read": "2026-11-03" } ] }, "pricing": { "status": "not_documented", "score": 3, "reason": "No pricing page reached.", "vendor_claim": false, "sources": [ { "url": "https://www.sekoia.com/", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 11, "maturity_max": 33, "maturity_core_30": 9.5, "counts": { "documented": 6, "partial": 10, "not_documented": 17 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "documented", "note": "'Sigma Rules' page: native Sigma YAML, including event_count, value_count and temporal correlation", "url": "https://docs.sekoia.com/xdr/features/detect/sigma/", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "lucene_kql_like": { "status": "partial", "note": "'SOL' (Sekoia Operating Language) queries run as scheduled detection rules; syntax relation to KQL not stated", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "Git module action triggers playbooks on repository file changes; no rule sync documented", "url": "https://docs.sekoia.com/integration/action_library/git/", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "api_rule_crud": { "status": "documented", "note": "'Create a SIGMA rule' tutorial: POST /v1/sic/conf/rules-catalog/rules; search rules tutorial", "url": "https://docs.sekoia.com/developer/tutorials/create_sigma_rule/", "read": "2026-11-03" }, "ci_examples": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "unit_tests": { "status": "partial", "note": "'Rule testing' with 'Test pattern' on historical data; no sample-event test cases", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "replay_historical": { "status": "documented", "note": "'Rule testing': evaluate a Sigma pattern against historical data", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "backtest_reports": { "status": "partial", "note": "'Test results visualization' shows detection frequency and event distribution; not saved as a report", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "'Security Profile (MITRE ATT&CK)' matrix built from rule tags", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "attack_gap_view": { "status": "partial", "note": "Matrix cells colored by rule count; gaps are inferred from empty cells, no gap report named", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "Rules list 'Compatible intake formats'; 'Asset connector health status' (Reveal module)", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "Rule cards show compatible intake formats; no source health tied to rules", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "partial", "note": "'Alert similarity' groups repeat matches 'rather than flooding the alert list'; 'Alert filters'; threshold tuning guidance", "url": "https://docs.sekoia.com/xdr/features/detect/sol_detection_similarity/", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "partial", "note": "'Lag management' keeps SOL rules from missing late events; no failed-rule alerting on pages read", "url": "https://docs.sekoia.com/xdr/features/detect/sol_detection_lag_management/", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "rule_performance_cost": { "status": "partial", "note": "'Performance considerations' in testing best practices; no per-rule telemetry", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "lifecycle_states": { "status": "documented", "note": "'Rule Lifecycle': Active, Scheduled for Deprecation, Deprecated, with valid-until date and notifications", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "vendor_library_count": { "status": "documented", "note": "Sekoia Verified Rules: 'more than 1000 rules'", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "Verified rules 'continuously updated'; no cadence stated", "url": "https://docs.sekoia.com/xdr/features/detect/rules_catalog/", "read": "2026-11-03" } } } }, { "slug": "anvilogic", "name": "Anvilogic", "profiled": true, "rubric_total": 5.48, "rubric_parts": { "languages": 0.75, "git_ci": 0.9, "testing": 0.75, "coverage": 0.84, "rule_health": 1.08, "versioning": 0.4, "library": 0.4, "pricing": 0.36 }, "rubric_criteria": { "languages": { "status": "partial", "score": 5, "reason": "Detections deploy to Splunk, Azure Sentinel, CrowdStrike NG-SIEM and Elastic, but the page does not name the rule languages it emits.", "vendor_claim": true, "sources": [ { "url": "https://www.anvilogic.com/", "read": "2026-11-04" } ] }, "git_ci": { "status": "partial", "score": 5, "reason": "Page says 'Detection-as-Code with version control' but describes no repo sync, pull-request flow, CLI or API; docs.anvilogic.com redirects to a login.", "vendor_claim": true, "sources": [ { "url": "https://www.anvilogic.com/platform", "read": "2026-11-04" }, { "url": "https://docs.anvilogic.com", "read": "2026-11-04" } ] }, "testing": { "status": "partial", "score": 5, "reason": "Detections are said to be validated and pushed live 'within an afternoon', with no testing method described.", "vendor_claim": true, "sources": [ { "url": "https://www.anvilogic.com/platform", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 7, "reason": "Page claims tuning agents and coverage scoring against MITRE ATT&CK; no gap view or method is shown.", "vendor_claim": true, "sources": [ { "url": "https://www.anvilogic.com/platform", "read": "2026-11-04" } ] }, "rule_health": { "status": "partial", "score": 6, "reason": "Page says teams monitor coverage and detection health on one dashboard; no metric definitions, noisy-rule or drift detail.", "vendor_claim": true, "sources": [ { "url": "https://www.anvilogic.com/platform", "read": "2026-11-04" } ] }, "versioning": { "status": "partial", "score": 5, "reason": "Version control is claimed in one phrase with no rollback detail.", "vendor_claim": true, "sources": [ { "url": "https://www.anvilogic.com/platform", "read": "2026-11-04" } ] }, "library": { "status": "partial", "score": 5, "reason": "'Thousands of MITRE-mapped detections' with no count or date.", "vendor_claim": true, "sources": [ { "url": "https://www.anvilogic.com/platform", "read": "2026-11-04" } ] }, "pricing": { "status": "partial", "score": 6, "reason": "Free tier at 0 dollars a month with a 30-day trial is listed; Detect, Triage and AI Insights are contact sales.", "vendor_claim": false, "sources": [ { "url": "https://www.anvilogic.com/pricing", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 6.5, "maturity_max": 33, "maturity_core_30": 5.5, "counts": { "documented": 0, "partial": 13, "not_documented": 20 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "visual_builder": { "status": "partial", "note": "'reusable, low-code detection components'; Blueprints drag-and-drop workflows (product page)", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "Version control is internal to the platform; no git repository sync described", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "ci_examples": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "env_promotion": { "status": "partial", "note": "'Deploy everywhere from a single workflow across SIEMs and data platforms'; multi-platform deploy, not staged environments", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "unit_tests": { "status": "partial", "note": "Detection editor shows version with TEST and DEPLOY steps; 'validating logic' named; test cases not described", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "replay_historical": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "synthetic_events": { "status": "partial", "note": "'Attack Simulation' Blueprint pulls completed test results into a detection queue (product page)", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "partial", "note": "ATT&CK technique coverage shows Validated, Deployed and Gap; 'Track detection validation efforts'", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "attack_mapping": { "status": "partial", "note": "'Every detection mapped to MITRE ATT&CK tactics and techniques' (product page)", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "attack_gap_view": { "status": "partial", "note": "'Maturity Scoring': 'continuously measures your MITRE ATT&CK coverage, highlights gaps, and recommends what to build next'", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "data_source_coverage": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "'Health Insights' appears as a feature label only", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "partial", "note": "'Tuning' agents; '80% Less alert noise with continuous tuning' (vendor claim, no method)", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "partial", "note": "'watches coverage and detection health on one dashboard'; mechanics not described", "url": "https://www.anvilogic.com/platform", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "lifecycle_states": { "status": "partial", "note": "'version history, diffs, and rollback' for detections; no deprecation states", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'Anvilogic Armory': '3,500+ detections for any SIEM and Data Lake' (vendor claim)", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "'New content weekly, driven by trending threat intelligence'", "url": "https://www.anvilogic.com/detection-engineering", "read": "2026-11-03" } } } }, { "slug": "hunters", "name": "Hunters", "profiled": true, "rubric_total": 3.44, "rubric_parts": { "languages": 0.45, "git_ci": 0.54, "testing": 0.6, "coverage": 0.48, "rule_health": 0.63, "versioning": 0.24, "library": 0.32, "pricing": 0.18 }, "rubric_criteria": { "languages": { "status": "not_documented", "score": 3, "reason": "Data is normalised to OCSF; the platform page names no rule language.", "vendor_claim": false, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] }, "git_ci": { "status": "not_documented", "score": 3, "reason": "Page says customers are not required to build detections themselves; no repo sync or CI.", "vendor_claim": true, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] }, "testing": { "status": "not_documented", "score": 4, "reason": "Detections are 'continuously tested and refined by Team Axon' (vendor claim); customers get no documented test tooling.", "vendor_claim": true, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] }, "coverage": { "status": "not_documented", "score": 4, "reason": "No ATT&CK coverage view on the page read.", "vendor_claim": false, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] }, "rule_health": { "status": "not_documented", "score": 3.5, "reason": "Claims a 90 percent cut in excessive alerting (vendor claim, no method); no rule-level health view.", "vendor_claim": true, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] }, "versioning": { "status": "not_documented", "score": 3, "reason": "Not documented.", "vendor_claim": false, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] }, "library": { "status": "not_documented", "score": 4, "reason": "Built-in detections maintained by Team Axon; no count.", "vendor_claim": true, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] }, "pricing": { "status": "not_documented", "score": 3, "reason": "hunters.security/pricing returned 404.", "vendor_claim": false, "sources": [ { "url": "https://www.hunters.security/platform", "read": "2026-11-04" } ] } }, "matrix": { "maturity_score": 6.5, "maturity_max": 33, "maturity_core_30": 5.5, "counts": { "documented": 3, "partial": 7, "not_documented": 23 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "visual_builder": { "status": "partial", "note": "'Create a custom detector': guided Filter and Group By detector modes with 'Test logic'; not described as no-code", "url": "https://docs.hunters.ai/docs/create-a-custom-detector.md", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "ci_examples": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "replay_historical": { "status": "documented", "note": "'Test logic': choose a timeframe and view samples of events that would generate leads", "url": "https://docs.hunters.ai/docs/create-a-custom-detector.md", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "attack_mapping": { "status": "documented", "note": "'Threat Coverage' map on MITRE ATT&CK v14; detectors counted per technique", "url": "https://docs.hunters.ai/docs/understand-threat-coverage.md", "read": "2026-11-03" }, "attack_gap_view": { "status": "documented", "note": "Threat Coverage map: gray technique means 'currently not covered'", "url": "https://docs.hunters.ai/docs/understand-threat-coverage.md", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "Detector list shows data sources per detector; gray cells can reflect missing telemetry", "url": "https://docs.hunters.ai/docs/understand-threat-coverage.md", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "'About data health' monitors each data flow; not tied to detectors", "url": "https://docs.hunters.ai/docs/about-data-health.md", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "partial", "note": "Detectors page shows leads, alerts and clusters per detector and alert enablement overrides", "url": "https://docs.hunters.ai/docs/export-detections.md", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "lifecycle_states": { "status": "partial", "note": "Detectors page lists detector 'status' and alert enabled settings; no deprecation states", "url": "https://docs.hunters.ai/docs/export-detections.md", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'a library of hundreds of detectors'; no number", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "No page read for this platform names this feature", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "'continuously growing list'; no cadence", "url": "https://docs.hunters.ai/docs/detection.md", "read": "2026-11-03" } } } }, { "slug": "soc-prime", "name": "SOC Prime", "profiled": true, "rubric_total": 5.11, "rubric_parts": { "languages": 1.2, "git_ci": 0.72, "testing": 0.75, "coverage": 0.72, "rule_health": 0.54, "versioning": 0.32, "library": 0.56, "pricing": 0.3 }, "rubric_criteria": { "languages": { "status": "documented", "score": 8, "reason": "Uncoder AI page states 48 targets for Sigma conversion, 21 for direct translation and 65 for query optimisation, but does not name them.", "vendor_claim": true, "sources": [ { "url": "https://socprime.com/uncoder-ai/", "read": "2026-11-04" } ] }, "git_ci": { "status": "not_documented", "score": 4, "reason": "No git sync, CLI or pipeline steps could be read: docs.socprime.com did not resolve in this session and the continuous content management page returned 404.", "vendor_claim": false, "sources": [ { "url": "https://socprime.com/", "read": "2026-11-03" } ] }, "testing": { "status": "partial", "score": 5, "reason": "Uncoder AI page says it validates translated rules; no replay, unit test or backtest method is described on pages read.", "vendor_claim": true, "sources": [ { "url": "https://socprime.com/uncoder-ai/", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 6, "reason": "Uncoder auto-tags Sigma rules with ATT&CK techniques and a separate MITRE ATT&CK Audit service targets data visibility blind spots; no gap view is documented.", "vendor_claim": true, "sources": [ { "url": "https://socprime.com/uncoder-ai/", "read": "2026-11-04" } ] }, "rule_health": { "status": "not_documented", "score": 3, "reason": "No noisy-rule, broken-rule, field drift or performance telemetry feature appears on the pages read.", "vendor_claim": false, "sources": [ { "url": "https://socprime.com/", "read": "2026-11-03" }, { "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" } ] }, "versioning": { "status": "not_documented", "score": 4, "reason": "No versioning or rollback behaviour is described on the pages read.", "vendor_claim": false, "sources": [ { "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" } ] }, "library": { "status": "partial", "score": 7, "reason": "Marketplace claims 750,000+ rules on one page and 1M+ on the homepage; the two figures conflict and neither is dated.", "vendor_claim": true, "sources": [ { "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" }, { "url": "https://socprime.com/", "read": "2026-11-03" } ] }, "pricing": { "status": "partial", "score": 5, "reason": "Plans are quote only per the marketplace FAQ; the open-source Uncoder.IO converter is the free route; no tiers are published.", "vendor_claim": false, "sources": [ { "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 5, "maturity_max": 33, "maturity_core_30": 3.5, "counts": { "documented": 0, "partial": 10, "not_documented": 23 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "partial", "note": "Prime Detect 'Applies Sigma rules to streaming events' (product page)", "url": "https://socprime.com/prime-detect/", "read": "2026-11-03" }, "sigma_conversion": { "status": "partial", "note": "Prime Architect: 'Convert Sigma rules into 48 SIEM and platform languages'; platform page says 65 'Sigma translation languages' (counts differ)", "url": "https://socprime.com/prime-architect/", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "git_sync": { "status": "partial", "note": "Threat Detection Marketplace: 'Source detection rules into SOC Prime repository or your existing ones' (product page)", "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "ci_examples": { "status": "partial", "note": "Platform page lists 'adapt CI/CD workflows' as a benefit; no workflow shown", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "replay_historical": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "attack_mapping": { "status": "partial", "note": "Prime Detect: 'Each match carries severity and ATT&CK technique' (product page)", "url": "https://socprime.com/prime-detect/", "read": "2026-11-03" }, "attack_gap_view": { "status": "partial", "note": "Threat Detection Marketplace 'SOC Coverage: Track MITRE ATT&CK technique coverage'; 'MITRE ATT&CK Audit' service", "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "'SOC Coverage' also tracks 'log source coverage' (product page)", "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" }, "log_source_health_rules": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "lifecycle_states": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "Marketplace page '750,000+ Detection rules'; platform page '1,000,000+ detections'; Prime Detect '20,000+' (counts differ by page)", "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" }, "community_library": { "status": "partial", "note": "Uncoder.IO and Roota open-source language are linked from the site; community rule contribution not described", "url": "https://socprime.com/platform/", "read": "2026-11-03" }, "update_cadence": { "status": "partial", "note": "Marketplace page: '50+ Rules added every day'", "url": "https://socprime.com/threat-detection-marketplace/", "read": "2026-11-03" } } } }, { "slug": "detecteam", "name": "Detecteam", "profiled": true, "rubric_total": 5.26, "rubric_parts": { "languages": 0.75, "git_ci": 0.9, "testing": 1.05, "coverage": 0.84, "rule_health": 0.9, "versioning": 0.32, "library": 0.32, "pricing": 0.18 }, "rubric_criteria": { "languages": { "status": "partial", "score": 5, "reason": "Lists Splunk, Microsoft Sentinel, Google SecOps, Elastic Security, AWS Security, Databricks and Cribl Stream as targets; rule languages are not named.", "vendor_claim": true, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] }, "git_ci": { "status": "partial", "score": 5, "reason": "Home page lists a GitHub Actions integration and detection-as-code workflows with no repo sync, CLI or API detail.", "vendor_claim": true, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] }, "testing": { "status": "partial", "score": 7, "reason": "Generates attack behaviour data as the SIEM or data lake would see it, from an ATT&CK-based scenario library; method detail and replay mechanics are not published.", "vendor_claim": true, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 7, "reason": "Built on ATT&CK, STIX and TAXII, with coverage, quality and accuracy metrics; no sample view is published.", "vendor_claim": true, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] }, "rule_health": { "status": "partial", "score": 5, "reason": "Claims metrics on detection quality and accuracy; no noisy-rule, broken-rule or drift detail.", "vendor_claim": true, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] }, "versioning": { "status": "not_documented", "score": 4, "reason": "Versioning is not stated on the home page.", "vendor_claim": false, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] }, "library": { "status": "not_documented", "score": 4, "reason": "Refers to a 'Massive Attack & Detection Library' with no count.", "vendor_claim": true, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] }, "pricing": { "status": "not_documented", "score": 3, "reason": "Contact Us only; no pricing page found.", "vendor_claim": false, "sources": [ { "url": "https://detecteam.com", "read": "2026-11-04" } ] } }, "matrix": { "maturity_score": 3.5, "maturity_max": 33, "maturity_core_30": 3, "counts": { "documented": 0, "partial": 7, "not_documented": 26 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "ci_examples": { "status": "partial", "note": "'GitHub Actions' listed among integrations and partners; no workflow shown", "url": "https://detecteam.com/", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "unit_tests": { "status": "partial", "note": "'includes the required test to validate detection quality'; test format not described", "url": "https://detecteam.com/", "read": "2026-11-03" }, "replay_historical": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "synthetic_events": { "status": "partial", "note": "'Generate attack behavior data natively like your SIEM/XDR/Data Lake sees them' (scenario library)", "url": "https://detecteam.com/", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "partial", "note": "'Measure Detection Performance': metrics and evidence on what detections see and miss", "url": "https://detecteam.com/", "read": "2026-11-03" }, "attack_mapping": { "status": "partial", "note": "Built on 'ATT&CK Adversary Tactics & Techniques'; scenarios built from TTPs", "url": "https://detecteam.com/", "read": "2026-11-03" }, "attack_gap_view": { "status": "partial", "note": "'Baseline what your detections are seeing and what they do not see'", "url": "https://detecteam.com/", "read": "2026-11-03" }, "data_source_coverage": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "log_source_health_rules": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "lifecycle_states": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'Massive Attack & Detection Library'; no count stated", "url": "https://detecteam.com/", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" }, "update_cadence": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://detecteam.com/", "read": "2026-11-03" } } } }, { "slug": "mate-security", "name": "Mate Security", "profiled": true, "rubric_total": 3.98, "rubric_parts": { "languages": 0.45, "git_ci": 0.54, "testing": 0.45, "coverage": 0.72, "rule_health": 1.08, "versioning": 0.24, "library": 0.32, "pricing": 0.18 }, "rubric_criteria": { "languages": { "status": "not_documented", "score": 3, "reason": "The platform page does not say which rule languages Mate's agents write; the May 2026 blog mentions Sigma only as a general practice.", "vendor_claim": true, "sources": [ { "url": "https://mate.security/platform", "read": "2026-11-04" }, { "url": "https://mate.security/blog/detection-engineering", "read": "2026-11-04" } ] }, "git_ci": { "status": "not_documented", "score": 3, "reason": "No repo sync, pull-request flow, CLI or API is documented; the blog says it does not say whether Mate uses Git.", "vendor_claim": true, "sources": [ { "url": "https://mate.security/blog/detection-engineering", "read": "2026-11-04" } ] }, "testing": { "status": "not_documented", "score": 3, "reason": "No testing method for Mate-written detections is published.", "vendor_claim": true, "sources": [ { "url": "https://mate.security/platform", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 6, "reason": "Detection Library shows coverage bars by ATT&CK tactic (vendor page); tactic level only, no technique gap view described.", "vendor_claim": true, "sources": [ { "url": "https://mate.security/platform", "read": "2026-11-04" } ] }, "rule_health": { "status": "partial", "score": 6, "reason": "Library lists severity, health, status and agreement rate per detection, and detections are tuned or deprecated from investigation outcomes (vendor claim); no definitions, thresholds, field drift or performance telemetry.", "vendor_claim": true, "sources": [ { "url": "https://mate.security/platform", "read": "2026-11-04" } ] }, "versioning": { "status": "not_documented", "score": 3, "reason": "Version control and rollback for Mate detections are not described.", "vendor_claim": true, "sources": [ { "url": "https://mate.security/platform", "read": "2026-11-04" }, { "url": "https://mate.security/blog/detection-engineering", "read": "2026-11-04" } ] }, "library": { "status": "not_documented", "score": 4, "reason": "An 'Adaptive Detection Engineering Library' is named; no detection count or freshness date.", "vendor_claim": true, "sources": [ { "url": "https://mate.security/platform", "read": "2026-11-04" } ] }, "pricing": { "status": "not_documented", "score": 3, "reason": "No pricing page; calls to action are 'Get a demo'.", "vendor_claim": false, "sources": [ { "url": "https://mate.security/", "read": "2026-11-03" } ] } }, "matrix": { "maturity_score": 3.5, "maturity_max": 33, "maturity_core_30": 3, "counts": { "documented": 0, "partial": 7, "not_documented": 26 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "ci_examples": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "replay_historical": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "attack_mapping": { "status": "partial", "note": "Platform page: 'Detection coverage scales across the MITRE ATT&CK Framework' (claim, no per-rule mapping shown)", "url": "https://mate.security/platform", "read": "2026-11-03" }, "attack_gap_view": { "status": "partial", "note": "'Cut the noise, turn blind spots into detections'; 'Maximal Coverage'; no gap view described", "url": "https://mate.security/platform", "read": "2026-11-03" }, "data_source_coverage": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "Homepage use case 'Security Engineering: Tool & data-source health'; not tied to rules", "url": "https://mate.security/", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "partial", "note": "'Detection Engineering that Continuously Tunes': detections 'created, tuned, or deprecated based on investigation outcomes'", "url": "https://mate.security/platform", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "partial", "note": "Homepage use case 'Detection Engineering: Tuning, health & coverage'; health mechanics not described", "url": "https://mate.security/", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "lifecycle_states": { "status": "partial", "note": "Detections 'continuously created, tuned, or deprecated'; no states or handling documented", "url": "https://mate.security/platform", "read": "2026-11-03" }, "vendor_library_count": { "status": "partial", "note": "'Adaptive Detection Engineering Library'; no count stated", "url": "https://mate.security/platform", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" }, "update_cadence": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://mate.security/platform", "read": "2026-11-03" } } } }, { "slug": "cardinalops", "name": "CardinalOps (Cribl)", "profiled": false, "rubric_total": 3.96, "rubric_parts": { "languages": 0.45, "git_ci": 0.54, "testing": 0.45, "coverage": 0.84, "rule_health": 1.08, "versioning": 0.24, "library": 0.24, "pricing": 0.12 }, "rubric_criteria": { "languages": { "status": "not_documented", "score": 3, "reason": "cardinalops.com redirects to cribl.io; no rule language or SIEM support list is published under the CardinalOps name.", "vendor_claim": false, "sources": [ { "url": "https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/", "read": "2026-11-04" } ] }, "git_ci": { "status": "not_documented", "score": 3, "reason": "No git, CI or API documentation found after the redirect.", "vendor_claim": false, "sources": [ { "url": "https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/", "read": "2026-11-04" } ] }, "testing": { "status": "not_documented", "score": 3, "reason": "Cribl's release does not describe rule testing.", "vendor_claim": false, "sources": [ { "url": "https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 7, "reason": "Cribl's 2026-07-14 release says the product maps security controls against adversary behaviour to find and close coverage gaps (vendor claim, no method).", "vendor_claim": true, "sources": [ { "url": "https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/", "read": "2026-11-04" } ] }, "rule_health": { "status": "partial", "score": 6, "reason": "Same release says it finds and fixes broken or noisy rules (vendor claim, no method or metrics).", "vendor_claim": true, "sources": [ { "url": "https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/", "read": "2026-11-04" } ] }, "versioning": { "status": "not_documented", "score": 3, "reason": "Not documented.", "vendor_claim": false, "sources": [ { "url": "https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/", "read": "2026-11-04" } ] }, "library": { "status": "not_documented", "score": 3, "reason": "Not documented; Cribl Detect lists 8,000+ rule templates but that page does not mention CardinalOps.", "vendor_claim": false, "sources": [ { "url": "https://cribl.io/products/detect/", "read": "2026-11-04" } ] }, "pricing": { "status": "not_documented", "score": 2, "reason": "No pricing page; terms of the deal were not disclosed.", "vendor_claim": false, "sources": [ { "url": "https://cribl.io/news/cribl-acquires-cardinalops-to-expand-its-ai-platform-into-security-operations/", "read": "2026-11-04" } ] } }, "matrix": { "maturity_score": 3.5, "maturity_max": 33, "maturity_core_30": 3.5, "counts": { "documented": 0, "partial": 7, "not_documented": 26 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "ci_examples": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "replay_historical": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "attack_mapping": { "status": "partial", "note": "'maps existing detections to MITRE ATT&CK' (Cribl blog)", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "attack_gap_view": { "status": "partial", "note": "'surfaces coverage gaps, provides recommendations for new rules'", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "data_source_coverage": { "status": "partial", "note": "Detection posture analysis 'can point back to missing log sources, events, or fields'", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "log_source_health_rules": { "status": "partial", "note": "Coverage gaps traced to missing log sources or fields; no ongoing source health feature described", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "partial", "note": "'find and fix broken or noisy rules across the tools they already run'", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "partial", "note": "'validates rule health'; vendor research claims about 13% of SIEM rules are broken", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "partial", "note": "Broken rules attributed to 'schema drift, filter changes, or mismatched data models'; tuning workflows react as 'configurations drift'", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "lifecycle_states": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "vendor_library_count": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" }, "update_cadence": { "status": "not documented", "note": "Product pages read do not name this feature; no documentation portal was readable", "url": "https://cribl.io/blog/what-the-cardinalops-acquisition-means-for-you/", "read": "2026-11-03" } } } }, { "slug": "snapattack", "name": "SnapAttack (Cisco)", "profiled": false, "rubric_total": 4.61, "rubric_parts": { "languages": 0.75, "git_ci": 0.72, "testing": 0.9, "coverage": 0.84, "rule_health": 0.72, "versioning": 0.24, "library": 0.32, "pricing": 0.12 }, "rubric_criteria": { "languages": { "status": "partial", "score": 5, "reason": "Cisco's post says SnapAttack's translation technology converts existing SIEM content for Splunk Enterprise Security; languages are not named.", "vendor_claim": true, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "git_ci": { "status": "not_documented", "score": 4, "reason": "Post says it can author and manage content teams write themselves; no git or CI detail, and snapattack.com returned nothing readable.", "vendor_claim": false, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "testing": { "status": "partial", "score": 6, "reason": "Post says it continuously tests deployed detections (2024 vendor statement, no method).", "vendor_claim": true, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "coverage": { "status": "partial", "score": 7, "reason": "Post says it maps coverage and flags gaps in priority order (vendor statement, 2024).", "vendor_claim": true, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "rule_health": { "status": "not_documented", "score": 4, "reason": "Validation of deployed detections is mentioned; no noisy-rule, drift or performance feature.", "vendor_claim": false, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "versioning": { "status": "not_documented", "score": 3, "reason": "Not documented.", "vendor_claim": false, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "library": { "status": "not_documented", "score": 4, "reason": "The 10,000+ rules figure seen in search summaries could not be confirmed on a vendor page.", "vendor_claim": false, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] }, "pricing": { "status": "not_documented", "score": 2, "reason": "No current public price; the product is folded into Splunk.", "vendor_claim": false, "sources": [ { "url": "https://www.splunk.com/en_us/blog/security/cisco-intends-to-acquire-threat-detection-and-defense-company-snapattack.html", "read": "2026-11-04" } ] } }, "matrix": { "maturity_score": 0, "maturity_max": 33, "maturity_core_30": 0, "counts": { "documented": 0, "partial": 0, "not_documented": 33 }, "read": "2026-11-03", "cells": { "sigma_native": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "sigma_conversion": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "yara_l": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "spl": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "kql": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "eql_esql": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "python_detections": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "visual_builder": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "yara": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "lucene_kql_like": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "git_sync": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "pr_deployment": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "cli_validate_deploy": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "api_rule_crud": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "ci_examples": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "env_promotion": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "unit_tests": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "replay_historical": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "synthetic_events": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "backtest_reports": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "test_coverage_reporting": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "attack_mapping": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "attack_gap_view": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "data_source_coverage": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "log_source_health_rules": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "noisy_rule_detection": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "broken_silent_rule_detection": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "schema_drift_alerts": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "rule_performance_cost": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "lifecycle_states": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "vendor_library_count": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "community_library": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" }, "update_cadence": { "status": "not documented", "note": "snapattack.com serves a redirect to the Splunk Enterprise Security product page; no SnapAttack page names this feature", "url": "https://snapattack.com/", "read": "2026-11-03" } } } } ] }