Community rules

Community rules are detections written and shared by users, not by the product vendor. They widen coverage and speed up the response to a new threat. They also vary in quality and fit to your data, so they need review, conversion and testing before any of them goes live.

What Community rules means here

Look at the licence, the review process and how deprecated rules are handled. Contribution guidelines are a sign of process.

A community rule is a starting point. Convert it, test it on your data and own it.

Example of Community rules in Panther documentation

The panther-analysis README says all detections are developed by the Panther Team and the Community, and links contributing guidelines. raw.githubusercontent.com read 2026-11-03

Terms related to Community rules

• Sigma: Sigma is an open YAML format for describing log-based detections once, so converters can turn them into queries for different SIEMs.
• Content library: A content library is a vendor- or community-maintained set of ready-made detections.
• Detection repository: A detection repository is the git repository that holds rules, tests and pipeline files.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.