Detection as Code

Frequently asked questions

30 questions about detection engineering, how the scores are set and how to read the matrix.

What is detection as code?
It means detection rules live in a version-controlled repository, change through reviewed pull requests and reach the SIEM through a pipeline, not console edits. Sentinel's Repositories page, for example, says connecting a workspace to GitHub or Azure DevOps deploys updated analytics rules automatically when the repo changes. The practice gives you history, review and repeatable deploys. It does not make a rule good, which is why rule health is scored on its own here.
What is detection engineering?
Detection engineering is designing, writing, testing, deploying and maintaining the rules that raise alerts, then measuring whether they still work. Splunk's contentctl user guide lists the cycle as generate, validate, build, test and deploy. Detection as code is one way to run that cycle. A team can do detection engineering in a console, and the code workflow adds review and history on top.
Which rule languages do the profiled tools run?
Each platform runs its own. Sentinel uses KQL, Google SecOps uses YARA-L 2.0, and Splunk uses SPL. Elastic offers custom query rules in KQL or Lucene, event correlation in EQL and ES|QL. Panther detections are Python. Sekoia documents native Sigma YAML. Sigma is a format with no runtime that converts to several of these. Hunters and Mate name no rule language in the pages read.
How do I test a detection rule?
Start with unit tests: sample events and the alert outcome you expect. Panther documents this with test events and an expected result, run through panther_analysis_tool test. Elastic's detection-rules CLI has a test command, and Splunk's contentctl test runs detections against attack data in a live Splunk instance. Sentinel documents only a manual rerun. Then replay on historical data before enabling the rule.
What is replay and which tools document it?
Replay runs a rule over historical data to show what it would have alerted on. Google SecOps documents a Test rule over a time range and Retrohunt, Panther documents Data Replay in beta, Sentinel documents a Manual rerun, Elastic documents running rules manually over a past range, and Hunters has a Test logic step for custom detectors. Results are not always saved, so record them in the pull request.
Which tools document a CI pipeline?
Panther documents workflow YAML for GitHub Actions and CircleCI, and Splunk's contentctl ships sample GitHub Actions workflows that build and unit-test on pull_request, with loading left manual. Sentinel's repository connection creates the GitHub workflow or Azure DevOps pipeline for you. Elastic's README describes no CI workflow itself, and the DaC reference calls a pipeline optional. Google's pipeline detail comes from a community repository and blog post.
How do I deploy rules from git to Sentinel?
Use the Repositories feature. It connects a workspace to GitHub or Azure DevOps, creates the workflow, and uses smart deployments to push only the files that changed. Content deploys as Bicep or ARM templates, and a PowerShell script converts public YAML rules. A workspace can hold five connections. Custom detection rules as code are in preview. Microsoft says Azure portal support ends after 2027-03-31.
How do I manage Elastic detection rules as code?
Elastic keeps rules as TOML files in the detection-rules repository and ships a CLI with create-rule, test, validate-all, import-rules-to-repo and export-rules-from-repo. Installation needs Python 3.12 or later. The DaC reference describes the Git sync and API workflow. The README says hand-writing TOML is possible but not recommended, and it describes no CI workflow of its own.
How do I manage Google SecOps rules as code?
Use the Rules API, which creates a revision whenever rule text changes, together with the Content Manager CLI in the chronicle/detection-rules repository. The README describes a rule manager for a detection-as-code pipeline over the REST API. It does not describe a pull-request trigger. Google's main detection-as-code docs page returned 404 on 2026-11-04, so the pipeline detail rests on the README.
How does Splunk's contentctl fit into detection as code?
contentctl keeps content as YAML in the security_content layout and has commands init, new, validate, build and test. Its sample workflows build and unit-test on pull requests, and loading into Splunk is manual. The README says development is moving to Detection Studio and the repo no longer takes pull requests, so plan for the workflow to change.
How does Panther handle detections as code?
Detections are Python, kept in a repository with the panther_analysis_tool CLI. Its commands include test, validate, zip, upload and delete, and a benchmark command performance-tests one rule against a log type before deploy. A GitHub Actions or CircleCI workflow uploads content with an API token. Panther's docs also describe converting Sigma rules through sigma-cli.
Can I convert Sigma rules to my SIEM?
Probably. pySigma and sigma-cli convert Sigma rules through backend plugins. The backends page lists Splunk, Kusto (status Stable) and Elasticsearch, which converts to Lucene, ES|QL and EQL, and a Google SecOps backend with status Development. Panther documents its own conversion page. Convert, then test the output on your data, because field names rarely match without a pipeline.
What are the limits of Sigma conversion?
No total count of pySigma backends is published, and a backend can be in development, as the Google SecOps one is. Conversion changes a rule's text, not its fit: a field missing from your data model still breaks the query. sigma-cli converts but has no deploy step. Sigma also has no runtime, so rule health and testing come from the platform.
How do I map detections to ATT&CK?
Tag each rule with the techniques it detects, then let the platform draw the matrix. Sentinel has a rule field and a coverage page, Elastic maps custom rules in Advanced settings or in the threat field of the TOML file, and Sigma carries ATT&CK tags in each rule. Treat the matrix as intent. A mapped technique has a rule, and it has not been tested.
What is a coverage gap and how do I see one?
A coverage gap is a technique with no working detection. Elastic's coverage page suggests reading light or empty cells, and Hunters shows gray techniques as currently not covered, noting that gray can also mean missing telemetry. Sentinel adds simulated coverage from rules available but not enabled. Before writing a rule for a gap, check whether the data for it reaches the SIEM.
What does rule health mean?
Rule health is whether a detection still runs, still sees its data and still earns its alerts. This site checks five signals: noisy rule detection, broken or silent rule detection, field drift alerts, performance or cost telemetry and lifecycle states. A rule can be correct in the repository and unhealthy in production, which is why the criterion carries 18 of 100 points.
Which tools document noisy rule detection?
None documents an automatic noisy-rule flag in full. Elastic publishes a monthly Noise score for prebuilt rules (vendor claim). Google SecOps shows detection counts on a Rule Observability dashboard and advises rule exclusions. Hunters lists leads, alerts and clusters per detector, and Sekoia groups repeat matches with alert similarity. Sentinel, Panther and SOC Prime document nothing on noise in the pages read.
How do I find rules that stopped running?
Look for per-rule run status. Sentinel's SentinelHealth table records whether runs succeeded or failed and why, and a query lists auto-disabled scheduled rules. Elastic's Rule Monitoring tab shows succeeded, failed or warning status and gap duration. Google SecOps shows rule errors and Limited or Paused states. Panther raises a rule error when code raises or a scheduled rule runs over 15 seconds.
What is field drift, and does any tool alert on it?
Field drift is when the fields a rule uses change or stop appearing, so the rule quietly stops matching. In the docs read for this site, no tool documents an alert tied to the fields a rule uses. Elastic's Data Quality dashboard flags unsuccessful ECS mappings in indices, and Panther raises Log Classification Errors, but neither is tied to rule fields.
How do I roll back a rule?
It depends on the product. Sentinel treats the repository as the source of truth, so rollback is a git revert, and SentinelAudit records before and after values. Elastic's History view, from Elastic Stack 9.5, restores an earlier revision. Google SecOps creates a revision when rule text changes and lists them. Whichever you use, test the restored rule before it runs on live data.
How many rules does each product ship?
Counts depend on the page and often carry no date. Splunk's research site reports 2,207 detections, undated. Elastic's scoring post covers 1,781 prebuilt rules, while its security page says over 1,300. Sigma's README says more than 3,000. Sekoia says more than 1000 verified rules. SOC Prime's pages say 750,000+, 1,000,000+ and 20,000+, and Panther, Google SecOps and Mate give no count.
Should I buy detection content or write it?
Buy to start and write to fit. A library gives day-one coverage, and Hunters is the clearest buy-the-content model in the set. Writing gives you control and tests tied to your data. Panther, Elastic and Sentinel document the code side. Whichever you choose, replay vendor rules on your own logs before enabling them, since counts say nothing about fit.
What do these tools cost?
Prices vary in what they publish. Sentinel lists per-GB analytics and commitment tiers, and Elastic publishes ingest and retention rates with add-ons. Anvilogic lists a free tier and a 30-day trial. Splunk names activity-based, workload or ingest models without amounts. Panther, Sekoia, Hunters, SOC Prime, Detecteam and Mate publish no price, and Google SecOps pricing pages returned 404. Check the vendor's page for the current figure.
Which tool scores highest for detection as code?
Microsoft Sentinel scores 7.81 of 10 and Elastic Security 7.60. They are inside a 0.25 band, so treat them as level. Google Security Operations follows at 6.83, then Panther at 6.31 and Splunk Enterprise Security at 6.21, another band. The top three are SIEMs because SIEMs document more in public. Specialist vendors score lower mainly where their docs are not public.
How are scores set on this site?
Each tool is scored 0 to 10 on eight weighted criteria, from public documentation, repositories and vendor pages, read on the date shown. The weights sum to 100, and totals are computed in code. Documented scores 8.0 to 9.5, partial 5.0 to 7.0 and not documented 2.0 to 4.0. Totals within 0.25 are shown as a band, not a ladder.
Why is rule health scored on its own?
A rule that stops running or floods the queue is the failure a detection team meets most often, so rule health gets 18 of 100 points, as much as git and CI. It is also the least documented group: across the 33 capabilities in the matrix, none of the platforms read documents all five health signals. Scoring it apart stops a strong repository workflow from hiding a weak health story.
Why does Mate Security rank tenth of twelve?
Mate scores 3.98 of 10, tenth of the 12 profiled and eleventh of 14 scored. Coverage and rule health reach 6.0, from claims on its own platform page with no definitions. Languages, git and CI, testing, versioning and pricing score 3.0 because nothing is published. Panther, Elastic Security, Google Security Operations and Sekoia.io score higher on the rule-health columns of the matrix. New public detail on storage, tests and versioning would move five cells.
Can AI agents write and tune detections, and what should I ask?
Some vendors say so. Mate says its detections are created, tuned or deprecated from investigation outcomes, and Anvilogic pairs tuning agents with a claim of 80% less alert noise, both vendor claims with no method. Ask where rules are stored, which language they use, how each change is tested and versioned, and how a bad change is rolled back.
What changed in ownership among these vendors?
Four deals matter. Databricks agreed to acquire Panther on 2026-06-16, and Panther still ships under its name. Cribl announced it is acquiring CardinalOps on 2026-07-14, and cardinalops.com now redirects to cribl.io. Cisco completed its SnapAttack deal in early 2025 and folds it into Splunk. Cisco completed its Splunk acquisition on 2024-03-18. Check the vendor's current page before you sign.
How do I send a correction, and can a vendor pay to change a score?
Write to editor@detectionascode.com with the URL of a public page that names the feature. The cell is re-read, changed if the page supports it, and the change is logged with its date. Corrections are applied within ten working days. A vendor cannot pay to change a score, a rank or a read date. New public documentation is treated like any other source.