Elastic estate: ranking
A team running Elastic Security that keeps rules as TOML in the detection-rules repository, or wants to, and cares most about knowing which rules are noisy or failing.
How this ranking is weighted
Only products that name Elastic as a target are kept: Elastic itself, Anvilogic (deploys to Elastic, vendor claim), Detecteam (lists Elastic Security as a target, vendor claim) and Sigma and pySigma (an Elasticsearch backend that converts to Lucene, ES|QL and EQL). Rule health carries the heaviest weight (22), with git and CI at 20 and the library at 10 because Elastic's prebuilt rules come with a published monthly score. The result is Elastic Security 7.77, Anvilogic 5.47, Sigma and pySigma 5.24, Detecteam 5.22. The three add-ons are inside a 0.25 band of each other. Elastic's own scoring and Rule Monitoring tab are what the add-ons have to beat, and none of them documents either. The scores are the same eight criterion scores as the main rubric; only the weights change.
Weights for this buyer type against the site weights, in percent.
| Criterion | Site weight | This ranking |
|---|---|---|
| Rule languages and conversion paths | 15 | 10.0 |
| Git-native workflow and CI/CD | 18 | 20.0 |
| Testing | 15 | 15.0 |
| Coverage analytics | 12 | 10.0 |
| Rule health | 18 | 22.0 |
| Versioning and rollback | 8 | 8.0 |
| Content library size and freshness | 8 | 10.0 |
| Pricing transparency | 6 | 5.0 |
The ranking for elastic estate
Elastic estate ranking, totals out of 10 with the main rubric total beside each.
| # | Platform | This ranking | Band | Main rubric |
|---|---|---|---|---|
| 1 | Microsoft Sentinel | 7.87 | band A | 7.81 |
| 2 | Elastic Security | 7.77 | band A | 7.60 |
| 3 | Google Security Operations | 6.95 | 6.83 | |
| 4 | Panther | 6.20 | band B | 6.31 |
| 5 | Splunk Enterprise Security (Cisco) | 6.20 | band B | 6.21 |
| 6 | Anvilogic | 5.47 | band C | 5.48 |
| 7 | Sigma and pySigma | 5.24 | band C | 5.50 |
| 8 | Detecteam | 5.22 | band C | 5.26 |
| 9 | SOC Prime | 4.88 | 5.11 | |
| 10 | Mate Security | 4.06 | 3.98 | |
| 11 | Hunters | 3.46 | band D | 3.44 |
| 12 | Sekoia.io | 3.43 | band D | 3.46 |
- Band A: Microsoft Sentinel 7.87, Elastic Security 7.77. Spread 0.10.
- Band B: Panther 6.20, Splunk Enterprise Security (Cisco) 6.20. Spread 0.00.
- Band C: Anvilogic 5.47, Sigma and pySigma 5.24, Detecteam 5.22. Spread 0.25.
- Band D: Hunters 3.46, Sekoia.io 3.43. Spread 0.03.
Mate Security ranks tenth of 12 under these weights. That is where the published evidence puts it for this buyer; where it is behind, the profile says so.
Other buyer types: Microsoft Sentinel estate, Splunk estate, Google SecOps estate, A team starting detection as code from scratch with Sigma.