Hunters vs Sekoia.io
Hunters totals 3.44 and Sekoia totals 3.46 on the 10 point detection-as-code rubric (sources read 2026-11-03 and 2026-11-04). The totals sit within 0.25, too close for the evidence to separate them. The pair turns on rule languages: Sekoia documents it in full, and Hunters publishes nothing on it. Neither publishes anything on pricing.
The difference that decides this pair
The largest weighted gap on the rubric is rule languages and conversion paths: Sekoia.io scores 4.0 against 3.0 for Hunters, which is 0.15 of the 10 point total.
Hunters names no rule language and normalises data to OCSF; Sekoia, by contrast, runs native Sigma YAML, including event_count, value_count and temporal correlation, alongside its own SOL queries. docs.sekoia.com read 2026-11-03 hunters.security read 2026-11-04
Rubric side by side
Hunters totals 3.44 and Sekoia.io totals 3.46 out of 10. The two totals are within 0.25 of each other, too close for the evidence to separate them.
Rubric criteria for Hunters and Sekoia.io, scores out of 10. A plus marks a criterion where Sekoia.io scores higher, a minus where Hunters does.
| Marker | Criterion | Weight | Hunters | Sekoia.io |
|---|---|---|---|---|
| + | Rule languages and conversion paths | 15 | 3.0 | 4.0 |
| + | Git-native workflow and CI/CD | 18 | 3.0 | 3.5 |
| - | Testing | 15 | 4.0 | 3.5 |
| - | Coverage analytics | 12 | 4.0 | 3.5 |
| - | Rule health | 18 | 3.5 | 3.0 |
| Versioning and rollback | 8 | 3.0 | 3.0 | |
| Content library size and freshness | 8 | 4.0 | 4.0 | |
| Pricing transparency | 6 | 3.0 | 3.0 | |
| Total | 100 | 3.44 | 3.46 |
The 33 capabilities as a diff
Read it as a diff from Hunters to Sekoia.io: 11 of 33 rows differ. A plus marks a row where Sekoia.io documents more (9 rows), a minus a row where Hunters documents more (2 rows). Rows with no marker match.
Capability rows for Hunters and Sekoia.io, grouped. Changed rows are shaded and carry a marker.
| Marker | Capability | Hunters | Sekoia.io |
|---|---|---|---|
| Languages | |||
| Sekoia.io documents more | Sigma native | not documented | documented |
| Sigma conversion | not documented | not documented | |
| YARA-L | not documented | not documented | |
| SPL | not documented | not documented | |
| KQL | not documented | not documented | |
| EQL or ES|QL | not documented | not documented | |
| Python | not documented | not documented | |
| Hunters documents more | Visual builder | partial | not documented |
| YARA | not documented | not documented | |
| Sekoia.io documents more | Lucene or KQL-like | not documented | partial |
| Source control and CI | |||
| Git sync | not documented | not documented | |
| PR deploy | not documented | not documented | |
| CLI | not documented | not documented | |
| Sekoia.io documents more | Rule API | not documented | documented |
| CI examples | not documented | not documented | |
| Env promotion | not documented | not documented | |
| Testing | |||
| Sekoia.io documents more | Unit tests | not documented | partial |
| Replay | documented | documented | |
| Synthetic events | not documented | not documented | |
| Sekoia.io documents more | Backtest reports | not documented | partial |
| Test coverage | not documented | not documented | |
| Coverage analytics | |||
| ATT&CK map | documented | documented | |
| Hunters documents more | Gap view | documented | partial |
| Data sources | partial | partial | |
| Log source health | partial | partial | |
| Rule health | |||
| Noisy rules | partial | partial | |
| Sekoia.io documents more | Broken rules | not documented | partial |
| Field drift | not documented | not documented | |
| Sekoia.io documents more | Rule cost | not documented | partial |
| Sekoia.io documents more | Lifecycle | partial | documented |
| Library | |||
| Sekoia.io documents more | Library count | partial | documented |
| Community | not documented | not documented | |
| Cadence | partial | partial | |
documentedpartialnot documented
Sources for the rows that differ
- Sigma native (Sekoia.io documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sekoia.io: documented, 'Sigma Rules' page: native Sigma YAML, including event_count, value_count and temporal correlation docs.sekoia.com read 2026-11-03.
- Visual builder (Hunters documents more). Hunters: partial, 'Create a custom detector': guided Filter and Group By detector modes with 'Test logic'; not described as no-code docs.hunters.ai read 2026-11-03. Sekoia.io: not documented, No page read for this platform names this feature docs.sekoia.com read 2026-11-03.
- Lucene or KQL-like (Sekoia.io documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sekoia.io: partial, 'SOL' (Sekoia Operating Language) queries run as scheduled detection rules; syntax relation to KQL not stated docs.sekoia.com read 2026-11-03.
- Rule API (Sekoia.io documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sekoia.io: documented, 'Create a SIGMA rule' tutorial: POST /v1/sic/conf/rules-catalog/rules; search rules tutorial docs.sekoia.com read 2026-11-03.
- Unit tests (Sekoia.io documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sekoia.io: partial, 'Rule testing' with 'Test pattern' on historical data; no sample-event test cases docs.sekoia.com read 2026-11-03.
- Backtest reports (Sekoia.io documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sekoia.io: partial, 'Test results visualization' shows detection frequency and event distribution; not saved as a report docs.sekoia.com read 2026-11-03.
- Gap view (Hunters documents more). Hunters: documented, Threat Coverage map: gray technique means 'currently not covered' docs.hunters.ai read 2026-11-03. Sekoia.io: partial, Matrix cells colored by rule count; gaps are inferred from empty cells, no gap report named docs.sekoia.com read 2026-11-03.
- Broken rules (Sekoia.io documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sekoia.io: partial, 'Lag management' keeps SOL rules from missing late events; no failed-rule alerting on pages read docs.sekoia.com read 2026-11-03.
- Rule cost (Sekoia.io documents more). Hunters: not documented, No page read for this platform names this feature docs.hunters.ai read 2026-11-03. Sekoia.io: partial, 'Performance considerations' in testing best practices; no per-rule telemetry docs.sekoia.com read 2026-11-03.
- Lifecycle (Sekoia.io documents more). Hunters: partial, Detectors page lists detector 'status' and alert enabled settings; no deprecation states docs.hunters.ai read 2026-11-03. Sekoia.io: documented, 'Rule Lifecycle': Active, Scheduled for Deprecation, Deprecated, with valid-until date and notifications docs.sekoia.com read 2026-11-03.
- Library count (Sekoia.io documents more). Hunters: partial, 'a library of hundreds of detectors'; no number docs.hunters.ai read 2026-11-03. Sekoia.io: documented, Sekoia Verified Rules: 'more than 1000 rules' docs.sekoia.com read 2026-11-03.
Verdict by buyer type
Which of the two fits each kind of team.
| Buyer | Verdict |
|---|---|
| a team starting from scratch with Sigma | Sekoia is the better fit: it runs native Sigma YAML, correlation rules included, but documents no CI workflow; Hunters documents no Sigma path. |
| Microsoft Sentinel estate | Neither Hunters nor Sekoia documents a path for this buyer, so it does not separate them. |
| Elastic estate | Neither Hunters nor Sekoia documents a path for this buyer, so it does not separate them. |
When to pick each
Hunters: Pick Hunters when coverage analytics is the deciding need: it draws a Threat Coverage map on ATT&CK v14 with uncovered techniques in gray.
Sekoia.io: Pick Sekoia when CI and deployment is the deciding need: it documents a POST endpoint for creating Sigma rules and no git sync or CLI. It also leads on rule languages.
Profiles: Hunters, Sekoia.io. Alternatives: to Hunters, to Sekoia.io.