Detection as code

Detection as code means detection rules live in a version-controlled repository, change through reviewed pull requests, and reach the SIEM through a pipeline instead of console edits. The rule file becomes the source of truth. Teams do this to get history, review, tests and repeatable deploys for the rules that decide what the SOC sees.

What Detection as code means here

The practice has four parts: a repository, a review step, automated checks and an automated deploy. Products differ in how much of that they document. Panther and Elastic ship a CLI built for it. Sentinel and Google SecOps connect a repo or an API to the workspace.

It does not by itself make a rule good. A rule can be reviewed, tested, versioned and still be noisy or silent in production, which is why this site scores rule health on its own.

Example of Detection as code in Microsoft Sentinel documentation

Sentinel's Repositories page says that connecting a workspace to GitHub or Azure DevOps deploys updated analytics rules, hunting queries, parsers and playbooks automatically when the repository changes. learn.microsoft.com read 2026-11-03

Terms related to Detection as code

• Detection repository: A detection repository is the git repository that holds rules, tests and pipeline files.
• Pull request workflow: A pull request workflow is how a rule change is proposed, reviewed and approved before it ships.
• CI pipeline: A CI pipeline is the automated sequence that runs on each change to the rule repository: lint, validate, test and, on merge, deploy.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.