Detection as Code

Google Security Operations vs Hunters

Google Security Operations totals 6.83 and Hunters totals 3.44 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). Google Security Operations leads by 3.39 points. The pair turns on CI and deployment: Google Security Operations documents it in full, and Hunters publishes nothing on it. Neither publishes anything on pricing.

The difference that decides this pair

The largest weighted gap on the rubric is Git-native workflow and CI/CD: Google Security Operations scores 8.0 against 3.0 for Hunters, which is 0.90 of the 10 point total.

On CI and deployment, Google Security Operations ships a Content Manager CLI and a Rules API in a public detection-rules repo for a detection-as-code pipeline, while Hunters documents no repo sync or CI and says customers need not build detections themselves. raw.githubusercontent.com read 2026-11-03 hunters.security read 2026-11-04

Rubric side by side

Google Security Operations totals 6.83 and Hunters totals 3.44 out of 10.

Rubric criteria for Google Security Operations and Hunters, scores out of 10. A plus marks a criterion where Hunters scores higher, a minus where Google Security Operations does.

MarkerCriterionWeightGoogle Security OperationsHunters
-Rule languages and conversion paths157.03.0
-Git-native workflow and CI/CD188.03.0
-Testing158.04.0
Coverage analytics124.04.0
-Rule health188.03.5
-Versioning and rollback88.03.0
-Content library size and freshness85.04.0
Pricing transparency63.03.0
Total1006.833.44

The 33 capabilities as a diff

Read it as a diff from Google Security Operations to Hunters: 12 of 33 rows differ. A plus marks a row where Hunters documents more (1 row), a minus a row where Google Security Operations documents more (11 rows). Rows with no marker match.

Capability rows for Google Security Operations and Hunters, grouped. Changed rows are shaded and carry a marker.

MarkerCapabilityGoogle Security OperationsHunters
Languages
Sigma nativeGoogle Security Operations, Sigma native: not documentednot documentedHunters, Sigma native: not documentednot documented
Sigma conversionGoogle Security Operations, Sigma conversion: not documentednot documentedHunters, Sigma conversion: not documentednot documented
Google Security Operations documents moreYARA-LGoogle Security Operations, YARA-L: documenteddocumentedHunters, YARA-L: not documentednot documented
SPLGoogle Security Operations, SPL: not documentednot documentedHunters, SPL: not documentednot documented
KQLGoogle Security Operations, KQL: not documentednot documentedHunters, KQL: not documentednot documented
EQL or ES|QLGoogle Security Operations, EQL or ES|QL: not documentednot documentedHunters, EQL or ES|QL: not documentednot documented
PythonGoogle Security Operations, Python: not documentednot documentedHunters, Python: not documentednot documented
Hunters documents moreVisual builderGoogle Security Operations, Visual builder: not documentednot documentedHunters, Visual builder: partialpartial
YARAGoogle Security Operations, YARA: not documentednot documentedHunters, YARA: not documentednot documented
Lucene or KQL-likeGoogle Security Operations, Lucene or KQL-like: not documentednot documentedHunters, Lucene or KQL-like: not documentednot documented
Source control and CI
Google Security Operations documents moreGit syncGoogle Security Operations, Git sync: documenteddocumentedHunters, Git sync: not documentednot documented
Google Security Operations documents morePR deployGoogle Security Operations, PR deploy: partialpartialHunters, PR deploy: not documentednot documented
Google Security Operations documents moreCLIGoogle Security Operations, CLI: documenteddocumentedHunters, CLI: not documentednot documented
Google Security Operations documents moreRule APIGoogle Security Operations, Rule API: documenteddocumentedHunters, Rule API: not documentednot documented
CI examplesGoogle Security Operations, CI examples: not documentednot documentedHunters, CI examples: not documentednot documented
Env promotionGoogle Security Operations, Env promotion: not documentednot documentedHunters, Env promotion: not documentednot documented
Testing
Unit testsGoogle Security Operations, Unit tests: not documentednot documentedHunters, Unit tests: not documentednot documented
ReplayGoogle Security Operations, Replay: documenteddocumentedHunters, Replay: documenteddocumented
Google Security Operations documents moreSynthetic eventsGoogle Security Operations, Synthetic events: partialpartialHunters, Synthetic events: not documentednot documented
Google Security Operations documents moreBacktest reportsGoogle Security Operations, Backtest reports: partialpartialHunters, Backtest reports: not documentednot documented
Test coverageGoogle Security Operations, Test coverage: not documentednot documentedHunters, Test coverage: not documentednot documented
Coverage analytics
ATT&CK mapGoogle Security Operations, ATT&CK map: documenteddocumentedHunters, ATT&CK map: documenteddocumented
Gap viewGoogle Security Operations, Gap view: documenteddocumentedHunters, Gap view: documenteddocumented
Data sourcesGoogle Security Operations, Data sources: partialpartialHunters, Data sources: partialpartial
Log source healthGoogle Security Operations, Log source health: partialpartialHunters, Log source health: partialpartial
Rule health
Noisy rulesGoogle Security Operations, Noisy rules: partialpartialHunters, Noisy rules: partialpartial
Google Security Operations documents moreBroken rulesGoogle Security Operations, Broken rules: documenteddocumentedHunters, Broken rules: not documentednot documented
Field driftGoogle Security Operations, Field drift: not documentednot documentedHunters, Field drift: not documentednot documented
Google Security Operations documents moreRule costGoogle Security Operations, Rule cost: documenteddocumentedHunters, Rule cost: not documentednot documented
Google Security Operations documents moreLifecycleGoogle Security Operations, Lifecycle: documenteddocumentedHunters, Lifecycle: partialpartial
Library
Library countGoogle Security Operations, Library count: partialpartialHunters, Library count: partialpartial
Google Security Operations documents moreCommunityGoogle Security Operations, Community: documenteddocumentedHunters, Community: not documentednot documented
CadenceGoogle Security Operations, Cadence: partialpartialHunters, Cadence: partialpartial

documenteddocumentedpartialpartialnot documentednot documented

Sources for the rows that differ

Verdict by buyer type

Which of the two fits each kind of team.

BuyerVerdict
Google SecOps estateGoogle Security Operations is the better fit: it runs the estate natively, with YARA-L rules, a Rules API and a Content Manager CLI; Hunters documents no Google SecOps path.
a team starting from scratch with SigmaNeither Google Security Operations nor Hunters documents a path for this buyer, so it does not separate them.
Microsoft Sentinel estateNeither Google Security Operations nor Hunters documents a path for this buyer, so it does not separate them.

When to pick each

Google Security Operations: Pick Google Security Operations when testing is the deciding need: it tests a rule over a time range, retrohunts against historical data and offers event simulation (pre-GA). It also leads on CI and deployment.

Hunters: Pick Hunters when you want vendor-maintained detections for a small team rather than writing rules: it draws a Threat Coverage map on ATT&CK v14 with uncovered techniques in gray, though Google Security Operations documents more across the rubric.

Profiles: Google Security Operations, Hunters. Alternatives: to Google Security Operations, to Hunters.