Elastic Security vs Sekoia.io
Elastic Security totals 7.60 and Sekoia totals 3.46 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Elastic Security leads by 4.14 points. The pair turns on testing: Elastic Security documents it in full, and Sekoia documents it only in part, or as a vendor claim.
The difference that decides this pair
The largest weighted gap on the rubric is rule health: Elastic Security scores 9.0 against 3.0 for Sekoia.io, which is 1.08 of the 10 point total.
Sekoia tests a Sigma pattern against historical data in a rule testing view, with results that are not saved as a report; Elastic Security, by contrast, ships Python unit tests for rules in the detection-rules repo and can run a rule manually over a past time range. dac-reference.readthedocs.io read 2026-11-03 docs.sekoia.com read 2026-11-03
Rubric side by side
Elastic Security totals 7.60 and Sekoia.io totals 3.46 out of 10.
Rubric criteria for Elastic Security and Sekoia.io, scores out of 10. A plus marks a criterion where Sekoia.io scores higher, a minus where Elastic Security does.
| Marker | Criterion | Weight | Elastic Security | Sekoia.io |
|---|---|---|---|---|
| - | Rule languages and conversion paths | 15 | 7.0 | 4.0 |
| - | Git-native workflow and CI/CD | 18 | 8.0 | 3.5 |
| - | Testing | 15 | 7.0 | 3.5 |
| - | Coverage analytics | 12 | 5.0 | 3.5 |
| - | Rule health | 18 | 9.0 | 3.0 |
| - | Versioning and rollback | 8 | 8.0 | 3.0 |
| - | Content library size and freshness | 8 | 9.0 | 4.0 |
| - | Pricing transparency | 6 | 8.0 | 3.0 |
| Total | 100 | 7.60 | 3.46 |
The 33 capabilities as a diff
Read it as a diff from Elastic Security to Sekoia.io: 19 of 33 rows differ. A plus marks a row where Sekoia.io documents more (5 rows), a minus a row where Elastic Security documents more (14 rows). Rows with no marker match.
Capability rows for Elastic Security and Sekoia.io, grouped. Changed rows are shaded and carry a marker.
| Marker | Capability | Elastic Security | Sekoia.io |
|---|---|---|---|
| Languages | |||
| Sekoia.io documents more | Sigma native | not documented | documented |
| Sigma conversion | not documented | not documented | |
| YARA-L | not documented | not documented | |
| SPL | not documented | not documented | |
| KQL | not documented | not documented | |
| Elastic Security documents more | EQL or ES|QL | documented | not documented |
| Python | not documented | not documented | |
| Visual builder | not documented | not documented | |
| YARA | not documented | not documented | |
| Elastic Security documents more | Lucene or KQL-like | documented | partial |
| Source control and CI | |||
| Elastic Security documents more | Git sync | documented | not documented |
| Elastic Security documents more | PR deploy | partial | not documented |
| Elastic Security documents more | CLI | documented | not documented |
| Rule API | documented | documented | |
| Elastic Security documents more | CI examples | partial | not documented |
| Elastic Security documents more | Env promotion | partial | not documented |
| Testing | |||
| Elastic Security documents more | Unit tests | documented | partial |
| Replay | documented | documented | |
| Elastic Security documents more | Synthetic events | partial | not documented |
| Sekoia.io documents more | Backtest reports | not documented | partial |
| Test coverage | not documented | not documented | |
| Coverage analytics | |||
| ATT&CK map | documented | documented | |
| Elastic Security documents more | Gap view | documented | partial |
| Data sources | partial | partial | |
| Log source health | partial | partial | |
| Rule health | |||
| Sekoia.io documents more | Noisy rules | not documented | partial |
| Elastic Security documents more | Broken rules | documented | partial |
| Elastic Security documents more | Field drift | partial | not documented |
| Elastic Security documents more | Rule cost | documented | partial |
| Sekoia.io documents more | Lifecycle | partial | documented |
| Library | |||
| Sekoia.io documents more | Library count | partial | documented |
| Elastic Security documents more | Community | partial | not documented |
| Cadence | partial | partial | |
documentedpartialnot documented
Sources for the rows that differ
- Sigma native (Sekoia.io documents more). Elastic Security: not documented, No Sigma rule type on the rule-types page; Sigma not named on pages read elastic.co read 2026-11-03. Sekoia.io: documented, 'Sigma Rules' page: native Sigma YAML, including event_count, value_count and temporal correlation docs.sekoia.com read 2026-11-03.
- EQL or ES|QL (Elastic Security documents more). Elastic Security: documented, Rule types 'Event correlation (EQL)' and 'ES|QL' elastic.co read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Lucene or KQL-like (Elastic Security documents more). Elastic Security: documented, 'Custom query' rules match events using KQL or Lucene elastic.co read 2026-11-03. Sekoia.io: partial, 'SOL' (Sekoia Operating Language) queries run as scheduled detection rules; syntax relation to KQL not stated docs.sekoia.com read 2026-11-03.
- Git sync (Elastic Security documents more). Elastic Security: documented, DaC reference: 'Git Sync' between local repo and the VCS, using the detection-rules repo dac-reference.readthedocs.io read 2026-11-03. Sekoia.io: not documented, Git module action triggers playbooks on repository file changes; no rule sync documented docs.sekoia.com read 2026-11-03.
- PR deploy (Elastic Security documents more). Elastic Security: partial, DaC reference describes 'CI/CD Sync via APIs' and peer review practice; no PR-triggered deploy workflow shipped on pages read dac-reference.readthedocs.io read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- CLI (Elastic Security documents more). Elastic Security: documented, detection_rules CLI: validate-rule, validate-all, kibana import-rules, export-rules raw.githubusercontent.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- CI examples (Elastic Security documents more). Elastic Security: partial, Repo runs its own 'Unit Tests' GitHub Actions workflow; DaC reference says CI/CD pipeline is optional and gives no customer workflow YAML on pages read raw.githubusercontent.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Env promotion (Elastic Security documents more). Elastic Security: partial, DaC reference lists 'Pre-Production Testing' and 'Managing multiple rule sets'; no dev/staging/prod promotion flow described dac-reference.readthedocs.io read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Unit tests (Elastic Security documents more). Elastic Security: documented, 'Unit testing' sub-component: Python unit tests for rules in the detection-rules repo dac-reference.readthedocs.io read 2026-11-03. Sekoia.io: partial, 'Rule testing' with 'Test pattern' on historical data; no sample-event test cases docs.sekoia.com read 2026-11-03.
- Synthetic events (Elastic Security documents more). Elastic Security: partial, README lists an 'RTAs' (red team automation) section; generation of test events not described on pages read raw.githubusercontent.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Backtest reports (Sekoia.io documents more). Elastic Security: not documented, No page read for this platform names this feature dac-reference.readthedocs.io read 2026-11-03. Sekoia.io: partial, 'Test results visualization' shows detection frequency and event distribution; not saved as a report docs.sekoia.com read 2026-11-03.
- Gap view (Elastic Security documents more). Elastic Security: documented, 'MITRE ATT&CK coverage' page: 'Identifying coverage gaps' via light or empty cells elastic.co read 2026-11-03. Sekoia.io: partial, Matrix cells colored by rule count; gaps are inferred from empty cells, no gap report named docs.sekoia.com read 2026-11-03.
- Noisy rules (Sekoia.io documents more). Elastic Security: not documented, No page read for this platform names this feature dac-reference.readthedocs.io read 2026-11-03. Sekoia.io: partial, 'Alert similarity' groups repeat matches 'rather than flooding the alert list'; 'Alert filters'; threshold tuning guidance docs.sekoia.com read 2026-11-03.
- Broken rules (Elastic Security documents more). Elastic Security: documented, 'Rule execution status' (succeeded, failed, warning), 'Rule Monitoring' tab, gap duration, 'Fill rule execution gaps' elastic.co read 2026-11-03. Sekoia.io: partial, 'Lag management' keeps SOL rules from missing late events; no failed-rule alerting on pages read docs.sekoia.com read 2026-11-03.
- Field drift (Elastic Security documents more). Elastic Security: partial, 'Data Quality dashboard' flags 'unsuccessful mappings' to ECS in indices; no alert tied to rule fields elastic.co read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Rule cost (Elastic Security documents more). Elastic Security: documented, 'Execution results' tab shows execution duration; 'Detection rule monitoring dashboard' for performance metrics elastic.co read 2026-11-03. Sekoia.io: partial, 'Performance considerations' in testing best practices; no per-rule telemetry docs.sekoia.com read 2026-11-03.
- Lifecycle (Sekoia.io documents more). Elastic Security: partial, 'Handle deprecated prebuilt rules' on the Rules page; no lifecycle states for custom rules on pages read elastic.co read 2026-11-03. Sekoia.io: documented, 'Rule Lifecycle': Active, Scheduled for Deprecation, Deprecated, with valid-until date and notifications docs.sekoia.com read 2026-11-03.
- Library count (Sekoia.io documents more). Elastic Security: partial, 'Prebuilt detection rules reference' lists every prebuilt rule; page states no total elastic.co read 2026-11-03. Sekoia.io: documented, Sekoia Verified Rules: 'more than 1000 rules' docs.sekoia.com read 2026-11-03.
- Community (Elastic Security documents more). Elastic Security: partial, detection-rules README has 'How to contribute'; repo is Elastic's own rule set raw.githubusercontent.com read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
Verdict by buyer type
Which of the two fits each kind of team.
| Buyer | Verdict |
|---|---|
| Elastic estate | Elastic Security is the better fit: it runs the estate natively and ships a detection_rules CLI for rules as TOML files; Sekoia documents no Elastic path. |
| a team starting from scratch with Sigma | Sekoia is the better fit: it runs native Sigma YAML, correlation rules included, but documents no CI workflow; Elastic Security documents no Sigma conversion path on the pages read. |
| Microsoft Sentinel estate | Neither Elastic Security nor Sekoia documents a path for this buyer, so it does not separate them. |
When to pick each
Elastic Security: Pick Elastic Security when testing is the deciding need: it ships Python unit tests for rules in the detection-rules repo and can run a rule manually over a past time range. It also leads on CI and deployment.
Sekoia.io: Pick Sekoia when rule languages matters more to you than testing, where Elastic Security documents more: it runs native Sigma YAML, including event_count, value_count and temporal correlation, alongside its own SOL queries.
Profiles: Elastic Security, Sekoia.io. Alternatives: to Elastic Security, to Sekoia.io.