Detection as Code

Elastic Security vs Mate Security

Elastic Security totals 7.60 and Mate Security totals 3.98 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Elastic Security leads by 3.62 points. The pair turns on testing: Elastic Security documents it in full, and Mate Security publishes nothing on it. Mate Security ranks eleventh of fourteen on the proposed scores.

The difference that decides this pair

The largest weighted gap on the rubric is Git-native workflow and CI/CD: Elastic Security scores 8.0 against 3.0 for Mate Security, which is 0.90 of the 10 point total.

The pair splits on testing: Elastic Security ships Python unit tests for rules in the detection-rules repo and can run a rule manually over a past time range, and Mate Security publishes no testing method for the detections it writes. dac-reference.readthedocs.io read 2026-11-03 mate.security read 2026-11-03

Rubric side by side

Elastic Security totals 7.60 and Mate Security totals 3.98 out of 10.

Rubric criteria for Elastic Security and Mate Security, scores out of 10. A plus marks a criterion where Mate Security scores higher, a minus where Elastic Security does.

MarkerCriterionWeightElastic SecurityMate Security
-Rule languages and conversion paths157.03.0
-Git-native workflow and CI/CD188.03.0
-Testing157.03.0
+Coverage analytics125.06.0
-Rule health189.06.0
-Versioning and rollback88.03.0
-Content library size and freshness89.04.0
-Pricing transparency68.03.0
Total1007.603.98

The 33 capabilities as a diff

Read it as a diff from Elastic Security to Mate Security: 20 of 33 rows differ. A plus marks a row where Mate Security documents more (1 row), a minus a row where Elastic Security documents more (19 rows). Rows with no marker match.

Capability rows for Elastic Security and Mate Security, grouped. Changed rows are shaded and carry a marker.

MarkerCapabilityElastic SecurityMate Security
Languages
Sigma nativeElastic Security, Sigma native: not documentednot documentedMate Security, Sigma native: not documentednot documented
Sigma conversionElastic Security, Sigma conversion: not documentednot documentedMate Security, Sigma conversion: not documentednot documented
YARA-LElastic Security, YARA-L: not documentednot documentedMate Security, YARA-L: not documentednot documented
SPLElastic Security, SPL: not documentednot documentedMate Security, SPL: not documentednot documented
KQLElastic Security, KQL: not documentednot documentedMate Security, KQL: not documentednot documented
Elastic Security documents moreEQL or ES|QLElastic Security, EQL or ES|QL: documenteddocumentedMate Security, EQL or ES|QL: not documentednot documented
PythonElastic Security, Python: not documentednot documentedMate Security, Python: not documentednot documented
Visual builderElastic Security, Visual builder: not documentednot documentedMate Security, Visual builder: not documentednot documented
YARAElastic Security, YARA: not documentednot documentedMate Security, YARA: not documentednot documented
Elastic Security documents moreLucene or KQL-likeElastic Security, Lucene or KQL-like: documenteddocumentedMate Security, Lucene or KQL-like: not documentednot documented
Source control and CI
Elastic Security documents moreGit syncElastic Security, Git sync: documenteddocumentedMate Security, Git sync: not documentednot documented
Elastic Security documents morePR deployElastic Security, PR deploy: partialpartialMate Security, PR deploy: not documentednot documented
Elastic Security documents moreCLIElastic Security, CLI: documenteddocumentedMate Security, CLI: not documentednot documented
Elastic Security documents moreRule APIElastic Security, Rule API: documenteddocumentedMate Security, Rule API: not documentednot documented
Elastic Security documents moreCI examplesElastic Security, CI examples: partialpartialMate Security, CI examples: not documentednot documented
Elastic Security documents moreEnv promotionElastic Security, Env promotion: partialpartialMate Security, Env promotion: not documentednot documented
Testing
Elastic Security documents moreUnit testsElastic Security, Unit tests: documenteddocumentedMate Security, Unit tests: not documentednot documented
Elastic Security documents moreReplayElastic Security, Replay: documenteddocumentedMate Security, Replay: not documentednot documented
Elastic Security documents moreSynthetic eventsElastic Security, Synthetic events: partialpartialMate Security, Synthetic events: not documentednot documented
Backtest reportsElastic Security, Backtest reports: not documentednot documentedMate Security, Backtest reports: not documentednot documented
Test coverageElastic Security, Test coverage: not documentednot documentedMate Security, Test coverage: not documentednot documented
Coverage analytics
Elastic Security documents moreATT&CK mapElastic Security, ATT&CK map: documenteddocumentedMate Security, ATT&CK map: partialpartial
Elastic Security documents moreGap viewElastic Security, Gap view: documenteddocumentedMate Security, Gap view: partialpartial
Elastic Security documents moreData sourcesElastic Security, Data sources: partialpartialMate Security, Data sources: not documentednot documented
Log source healthElastic Security, Log source health: partialpartialMate Security, Log source health: partialpartial
Rule health
Mate Security documents moreNoisy rulesElastic Security, Noisy rules: not documentednot documentedMate Security, Noisy rules: partialpartial
Elastic Security documents moreBroken rulesElastic Security, Broken rules: documenteddocumentedMate Security, Broken rules: partialpartial
Elastic Security documents moreField driftElastic Security, Field drift: partialpartialMate Security, Field drift: not documentednot documented
Elastic Security documents moreRule costElastic Security, Rule cost: documenteddocumentedMate Security, Rule cost: not documentednot documented
LifecycleElastic Security, Lifecycle: partialpartialMate Security, Lifecycle: partialpartial
Library
Library countElastic Security, Library count: partialpartialMate Security, Library count: partialpartial
Elastic Security documents moreCommunityElastic Security, Community: partialpartialMate Security, Community: not documentednot documented
Elastic Security documents moreCadenceElastic Security, Cadence: partialpartialMate Security, Cadence: not documentednot documented

documenteddocumentedpartialpartialnot documentednot documented

Sources for the rows that differ

Verdict by buyer type

Which of the two fits each kind of team.

BuyerVerdict
Elastic estateElastic Security is the better fit: it runs the estate natively and ships a detection_rules CLI for rules as TOML files; Mate Security is described by Google as working with existing SIEM tools, with no Elastic connector documented.
a team starting from scratch with SigmaNeither Elastic Security nor Mate Security documents a path for this buyer, so it does not separate them.
Microsoft Sentinel estateNeither Elastic Security nor Mate Security documents a path for this buyer, so it does not separate them.

When to pick each

Elastic Security: Pick Elastic Security when testing is the deciding need: it ships Python unit tests for rules in the detection-rules repo and can run a rule manually over a past time range. It also leads on CI and deployment.

Mate Security: Pick Mate Security when rule health matters more to you than testing, where Elastic Security documents more: it says detections are tuned or deprecated from investigation outcomes (vendor claim) and publishes no definitions or thresholds.

Profiles: Elastic Security, Mate Security. Alternatives: to Elastic Security, to Mate Security.