Detection as Code

Elastic Security vs Hunters

Elastic Security totals 7.60 and Hunters totals 3.44 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Elastic Security leads by 4.16 points. The pair turns on rule languages: Elastic Security documents it in full, and Hunters publishes nothing on it.

The difference that decides this pair

The largest weighted gap on the rubric is rule health: Elastic Security scores 9.0 against 3.5 for Hunters, which is 0.99 of the 10 point total.

Hunters names no rule language and normalises data to OCSF; Elastic Security, by contrast, runs EQL, ES|QL, KQL and Lucene rules and documents no Sigma conversion. elastic.co read 2026-11-03 hunters.security read 2026-11-04

Rubric side by side

Elastic Security totals 7.60 and Hunters totals 3.44 out of 10.

Rubric criteria for Elastic Security and Hunters, scores out of 10. A plus marks a criterion where Hunters scores higher, a minus where Elastic Security does.

MarkerCriterionWeightElastic SecurityHunters
-Rule languages and conversion paths157.03.0
-Git-native workflow and CI/CD188.03.0
-Testing157.04.0
-Coverage analytics125.04.0
-Rule health189.03.5
-Versioning and rollback88.03.0
-Content library size and freshness89.04.0
-Pricing transparency68.03.0
Total1007.603.44

The 33 capabilities as a diff

Read it as a diff from Elastic Security to Hunters: 16 of 33 rows differ. A plus marks a row where Hunters documents more (2 rows), a minus a row where Elastic Security documents more (14 rows). Rows with no marker match.

Capability rows for Elastic Security and Hunters, grouped. Changed rows are shaded and carry a marker.

MarkerCapabilityElastic SecurityHunters
Languages
Sigma nativeElastic Security, Sigma native: not documentednot documentedHunters, Sigma native: not documentednot documented
Sigma conversionElastic Security, Sigma conversion: not documentednot documentedHunters, Sigma conversion: not documentednot documented
YARA-LElastic Security, YARA-L: not documentednot documentedHunters, YARA-L: not documentednot documented
SPLElastic Security, SPL: not documentednot documentedHunters, SPL: not documentednot documented
KQLElastic Security, KQL: not documentednot documentedHunters, KQL: not documentednot documented
Elastic Security documents moreEQL or ES|QLElastic Security, EQL or ES|QL: documenteddocumentedHunters, EQL or ES|QL: not documentednot documented
PythonElastic Security, Python: not documentednot documentedHunters, Python: not documentednot documented
Hunters documents moreVisual builderElastic Security, Visual builder: not documentednot documentedHunters, Visual builder: partialpartial
YARAElastic Security, YARA: not documentednot documentedHunters, YARA: not documentednot documented
Elastic Security documents moreLucene or KQL-likeElastic Security, Lucene or KQL-like: documenteddocumentedHunters, Lucene or KQL-like: not documentednot documented
Source control and CI
Elastic Security documents moreGit syncElastic Security, Git sync: documenteddocumentedHunters, Git sync: not documentednot documented
Elastic Security documents morePR deployElastic Security, PR deploy: partialpartialHunters, PR deploy: not documentednot documented
Elastic Security documents moreCLIElastic Security, CLI: documenteddocumentedHunters, CLI: not documentednot documented
Elastic Security documents moreRule APIElastic Security, Rule API: documenteddocumentedHunters, Rule API: not documentednot documented
Elastic Security documents moreCI examplesElastic Security, CI examples: partialpartialHunters, CI examples: not documentednot documented
Elastic Security documents moreEnv promotionElastic Security, Env promotion: partialpartialHunters, Env promotion: not documentednot documented
Testing
Elastic Security documents moreUnit testsElastic Security, Unit tests: documenteddocumentedHunters, Unit tests: not documentednot documented
ReplayElastic Security, Replay: documenteddocumentedHunters, Replay: documenteddocumented
Elastic Security documents moreSynthetic eventsElastic Security, Synthetic events: partialpartialHunters, Synthetic events: not documentednot documented
Backtest reportsElastic Security, Backtest reports: not documentednot documentedHunters, Backtest reports: not documentednot documented
Test coverageElastic Security, Test coverage: not documentednot documentedHunters, Test coverage: not documentednot documented
Coverage analytics
ATT&CK mapElastic Security, ATT&CK map: documenteddocumentedHunters, ATT&CK map: documenteddocumented
Gap viewElastic Security, Gap view: documenteddocumentedHunters, Gap view: documenteddocumented
Data sourcesElastic Security, Data sources: partialpartialHunters, Data sources: partialpartial
Log source healthElastic Security, Log source health: partialpartialHunters, Log source health: partialpartial
Rule health
Hunters documents moreNoisy rulesElastic Security, Noisy rules: not documentednot documentedHunters, Noisy rules: partialpartial
Elastic Security documents moreBroken rulesElastic Security, Broken rules: documenteddocumentedHunters, Broken rules: not documentednot documented
Elastic Security documents moreField driftElastic Security, Field drift: partialpartialHunters, Field drift: not documentednot documented
Elastic Security documents moreRule costElastic Security, Rule cost: documenteddocumentedHunters, Rule cost: not documentednot documented
LifecycleElastic Security, Lifecycle: partialpartialHunters, Lifecycle: partialpartial
Library
Library countElastic Security, Library count: partialpartialHunters, Library count: partialpartial
Elastic Security documents moreCommunityElastic Security, Community: partialpartialHunters, Community: not documentednot documented
CadenceElastic Security, Cadence: partialpartialHunters, Cadence: partialpartial

documenteddocumentedpartialpartialnot documentednot documented

Sources for the rows that differ

Verdict by buyer type

Which of the two fits each kind of team.

BuyerVerdict
Elastic estateElastic Security is the better fit: it runs the estate natively and ships a detection_rules CLI for rules as TOML files; Hunters documents no Elastic path.
a team starting from scratch with SigmaNeither Elastic Security nor Hunters documents a path for this buyer, so it does not separate them.
Microsoft Sentinel estateNeither Elastic Security nor Hunters documents a path for this buyer, so it does not separate them.

When to pick each

Elastic Security: Pick Elastic Security when testing is the deciding need: it ships Python unit tests for rules in the detection-rules repo and can run a rule manually over a past time range. It also leads on CI and deployment.

Hunters: Pick Hunters when coverage analytics matters more to you than testing, where Elastic Security documents more: it draws a Threat Coverage map on ATT&CK v14 with uncovered techniques in gray.

Profiles: Elastic Security, Hunters. Alternatives: to Elastic Security, to Hunters.