Rankings by buyer type

One rubric does not fit every team. Each page below keeps the same eight criterion scores and changes the weights to suit one kind of buyer, then re-ranks the 12 profiled platforms. Where totals are within 0.25 they are a band.

• Microsoft Sentinel estate. A detection team already running Microsoft Sentinel that writes KQL analytics rules and wants a repository workflow, tests and proof that rules run.
• Elastic estate. A team running Elastic Security that keeps rules as TOML in the detection-rules repository, or wants to, and cares most about knowing which rules are noisy or failing.
• Splunk estate. A team running Splunk Enterprise Security with SPL detections, ESCU content and contentctl, deciding what to add as Splunk moves development to Detection Studio.
• Google SecOps estate. A team running Google Security Operations that writes YARA-L, uses the Rules API and the Content Manager CLI, and wants revisions and replay handled well.
• A team starting detection as code from scratch with Sigma. A small team with no SIEM lock-in that wants to write rules in Sigma, keep them in git and test them before they ship.

The main ranking is on the rubric page.