Detection repository

A detection repository is the git repository that holds rules, tests and pipeline files. It is the working copy of the detection program, and the thing a reviewer reads. The layout, the validator and the deploy command usually come from the vendor's own tooling or a public template.

What Detection repository means here

Public repositories double as content libraries: you can fork them, read the rules and run their tests.

Decide early whether one repo holds everything or each platform gets its own.

Example of Detection repository in Microsoft Sentinel documentation

The Azure-Sentinel GitHub repository is MIT-licensed, shows about 60,920 commits, and holds playbook templates that deploy with a Deploy to Azure button. github.com read 2026-11-03

Terms related to Detection repository

• Detection as code: Detection as code means detection rules live in a version-controlled repository, change through reviewed pull requests, and reach the SIEM through a pipeline instead of console edits.
• Pull request workflow: A pull request workflow is how a rule change is proposed, reviewed and approved before it ships.
• Community rules: Community rules are detections written and shared by users, not by the product vendor.

The matrix scores platforms on whether they document these ideas: see the matrix and the full glossary.