A team starting detection as code from scratch with Sigma: ranking
A small team with no SIEM lock-in that wants to write rules in Sigma, keep them in git and test them before they ship.
How this ranking is weighted
Products are kept if they run Sigma natively, document a Sigma conversion, or appear as a target on the Sigma backends page: Sentinel (Kusto, Stable), Elastic, Splunk, Google SecOps (Development), Panther (sigma-cli conversion), Sekoia (native Sigma), SOC Prime (conversion, vendor claim) and Sigma and pySigma itself. Anvilogic, Detecteam, Hunters and Mate are out because their pages name no Sigma path; Mate's blog mentions Sigma only as a general practice. Languages is weighted 25, git and CI 20 and testing 15. The result is Microsoft Sentinel 7.67, Elastic Security 7.54, Google Security Operations 6.79, Panther 6.75, Splunk Enterprise Security 6.41, Sigma and pySigma 6.18, SOC Prime 5.53, Sekoia 3.54. Sentinel and Elastic are a band, and Google and Panther are a band 0.04 apart. A Sigma-first team should read the third and fourth places as equals: Panther documents the conversion step, and Google documents revisions and retrohunt. The scores are the same eight criterion scores as the main rubric; only the weights change.
Weights for this buyer type against the site weights, in percent.
| Criterion | Site weight | This ranking |
|---|---|---|
| Rule languages and conversion paths | 15 | 25.0 |
| Git-native workflow and CI/CD | 18 | 20.0 |
| Testing | 15 | 15.0 |
| Coverage analytics | 12 | 8.0 |
| Rule health | 18 | 10.0 |
| Versioning and rollback | 8 | 6.0 |
| Content library size and freshness | 8 | 8.0 |
| Pricing transparency | 6 | 8.0 |
The ranking for a team starting detection as code from scratch with sigma
A team starting detection as code from scratch with Sigma ranking, totals out of 10 with the main rubric total beside each.
| # | Platform | This ranking | Band | Main rubric |
|---|---|---|---|---|
| 1 | Microsoft Sentinel | 7.67 | band A | 7.81 |
| 2 | Elastic Security | 7.54 | band A | 7.60 |
| 3 | Google Security Operations | 6.79 | band B | 6.83 |
| 4 | Panther | 6.75 | band B | 6.31 |
| 5 | Splunk Enterprise Security (Cisco) | 6.41 | band C | 6.21 |
| 6 | Sigma and pySigma | 6.19 | band C | 5.50 |
| 7 | SOC Prime | 5.53 | band D | 5.11 |
| 8 | Anvilogic | 5.34 | band D | 5.48 |
| 9 | Detecteam | 5.16 | 5.26 | |
| 10 | Mate Security | 3.62 | band E | 3.98 |
| 11 | Sekoia.io | 3.55 | band E | 3.46 |
| 12 | Hunters | 3.36 | 3.44 |
- Band A: Microsoft Sentinel 7.67, Elastic Security 7.54. Spread 0.13.
- Band B: Google Security Operations 6.79, Panther 6.75. Spread 0.04.
- Band C: Splunk Enterprise Security (Cisco) 6.41, Sigma and pySigma 6.19. Spread 0.22.
- Band D: SOC Prime 5.53, Anvilogic 5.34. Spread 0.19.
- Band E: Mate Security 3.62, Sekoia.io 3.55. Spread 0.07.
Mate Security ranks tenth of 12 under these weights. That is where the published evidence puts it for this buyer; where it is behind, the profile says so.
Other buyer types: Microsoft Sentinel estate, Elastic estate, Splunk estate, Google SecOps estate.