# Detection as Code > Capability matrix and head-to-heads for detection engineering tools, scored from public documentation, with rule health scored as its own group. ## Start here - [Detection-as-code maturity matrix: 14 platforms, 33 capabilities](https://detectionascode.com/): Capability matrix and head-to-heads for detection engineering tools, scored from public documentation, with rule health scored as its own group. ## Method - [Rubric: how detection-as-code platforms are scored](https://detectionascode.com/method): Eight weighted criteria, scored 0 to 10 from public documentation, with the evidence rules, the score bands and a worked example of how a total is computed. ## Matrix - [The detection-as-code maturity matrix, 14 platforms by 33 capabilities](https://detectionascode.com/matrix): The full matrix of 14 detection platforms against 33 capabilities in six groups, with definitions, group filters and the text table behind the squares. - [Languages: matrix group](https://detectionascode.com/matrix/languages): The languages group of the detection-as-code matrix: 10 capabilities across 14 platforms with the source and read date for each cell. - [Source control and CI: matrix group](https://detectionascode.com/matrix/source-control-ci): The source control and ci group of the detection-as-code matrix: 6 capabilities across 14 platforms with the source and read date for each cell. - [Testing: matrix group](https://detectionascode.com/matrix/testing): The testing group of the detection-as-code matrix: 5 capabilities across 14 platforms with the source and read date for each cell. - [Coverage analytics: matrix group](https://detectionascode.com/matrix/coverage): The coverage analytics group of the detection-as-code matrix: 4 capabilities across 14 platforms with the source and read date for each cell. - [Library: matrix group](https://detectionascode.com/matrix/library): The library group of the detection-as-code matrix: 3 capabilities across 14 platforms with the source and read date for each cell. - [Rule health: what each platform documents](https://detectionascode.com/matrix/health): What 14 detection platforms document about noisy rules, broken or silent rules, field drift and rule cost, with the quote and source behind each cell. - [Matrix method: how the 33 capabilities were read](https://detectionascode.com/matrix/method): How the detection-as-code matrix was built: the 33 capabilities, the three statuses, how the score is counted, where documentation could not be read and what the matrix does not measure. - [Data: detection-as-code matrix as CSV and JSON](https://detectionascode.com/data): Download the detection-as-code maturity matrix and rubric scores as CSV or JSON under CC BY 4.0, with a note, source and read date for every cell. ## Platforms - [SOC Prime: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/soc-prime): SOC Prime scores 5.11 of 10 on the detection-as-code rubric and documents 5.0 of 33 matrix capabilities, with sources and read dates. - [Anvilogic: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/anvilogic): Anvilogic scores 5.48 of 10 on the detection-as-code rubric and documents 6.5 of 33 matrix capabilities, with sources and read dates. - [Panther: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/panther): Panther scores 6.31 of 10 on the detection-as-code rubric and documents 18.0 of 33 matrix capabilities, with sources and read dates. - [Sigma and pySigma: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/sigma-pysigma): Sigma and pySigma scores 5.50 of 10 on the detection-as-code rubric and documents 12.0 of 33 matrix capabilities, with sources and read dates. - [Detecteam: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/detecteam): Detecteam scores 5.26 of 10 on the detection-as-code rubric and documents 3.5 of 33 matrix capabilities, with sources and read dates. - [Elastic Security: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/elastic-security): Elastic Security scores 7.60 of 10 on the detection-as-code rubric and documents 16.5 of 33 matrix capabilities, with sources and read dates. - [Splunk Enterprise Security (Cisco): detection-as-code profile, score and matrix](https://detectionascode.com/platforms/splunk-enterprise-security): Splunk Enterprise Security (Cisco) scores 6.21 of 10 on the detection-as-code rubric and documents 13.5 of 33 matrix capabilities, with sources and read dates. - [Sekoia.io: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/sekoia): Sekoia.io scores 3.46 of 10 on the detection-as-code rubric and documents 11.0 of 33 matrix capabilities, with sources and read dates. - [Hunters: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/hunters): Hunters scores 3.44 of 10 on the detection-as-code rubric and documents 6.5 of 33 matrix capabilities, with sources and read dates. - [Google Security Operations: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/google-secops): Google Security Operations scores 6.83 of 10 on the detection-as-code rubric and documents 15.0 of 33 matrix capabilities, with sources and read dates. - [Microsoft Sentinel: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/microsoft-sentinel): Microsoft Sentinel scores 7.81 of 10 on the detection-as-code rubric and documents 12.5 of 33 matrix capabilities, with sources and read dates. - [Mate Security: detection-as-code profile, score and matrix](https://detectionascode.com/platforms/mate-security): Mate Security scores 3.98 of 10 on the detection-as-code rubric and documents 3.5 of 33 matrix capabilities, with sources and read dates. - [CardinalOps (Cribl): scored, not profiled](https://detectionascode.com/platforms/cardinalops): CardinalOps (Cribl) is scored in the detection-as-code dataset but not profiled: acquired by Cribl (announced 2026-07-14); no longer ships under its own name. Rubric total 3.96 of 10. - [SnapAttack (Cisco): scored, not profiled](https://detectionascode.com/platforms/snapattack): SnapAttack (Cisco) is scored in the detection-as-code dataset but not profiled: acquired by Cisco (completed 2025-01-31 per Splunk); no longer ships under its own name. Rubric total 4.61 of 10. - [Platforms: profiles of 12 detection-as-code tools](https://detectionascode.com/platforms): Twelve detection-as-code platforms profiled on one rubric and one matrix, plus short notes on two scored products that no longer ship under their own names. ## Head-to-heads - [Anvilogic vs Detecteam: capability diff](https://detectionascode.com/diff/anvilogic-vs-detecteam): Anvilogic and Detecteam compared on the same rubric and 33 capabilities: 8 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Elastic Security: capability diff](https://detectionascode.com/diff/anvilogic-vs-elastic-security): Anvilogic and Elastic Security compared on the same rubric and 33 capabilities: 19 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Google Security Operations: capability diff](https://detectionascode.com/diff/anvilogic-vs-google-secops): Anvilogic and Google Security Operations compared on the same rubric and 33 capabilities: 18 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Hunters: capability diff](https://detectionascode.com/diff/anvilogic-vs-hunters): Anvilogic and Hunters compared on the same rubric and 33 capabilities: 9 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Mate Security: capability diff](https://detectionascode.com/diff/anvilogic-vs-mate-security): Anvilogic and Mate Security compared on the same rubric and 33 capabilities: 6 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Microsoft Sentinel: capability diff](https://detectionascode.com/diff/anvilogic-vs-microsoft-sentinel): Anvilogic and Microsoft Sentinel compared on the same rubric and 33 capabilities: 19 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Panther: capability diff](https://detectionascode.com/diff/anvilogic-vs-panther): Anvilogic and Panther compared on the same rubric and 33 capabilities: 24 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Sekoia.io: capability diff](https://detectionascode.com/diff/anvilogic-vs-sekoia): Anvilogic and Sekoia.io compared on the same rubric and 33 capabilities: 14 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/anvilogic-vs-sigma-pysigma): Anvilogic and Sigma and pySigma compared on the same rubric and 33 capabilities: 22 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs SOC Prime: capability diff](https://detectionascode.com/diff/anvilogic-vs-soc-prime): Anvilogic and SOC Prime compared on the same rubric and 33 capabilities: 15 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Anvilogic vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/anvilogic-vs-splunk-enterprise-security): Anvilogic and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 18 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Elastic Security: capability diff](https://detectionascode.com/diff/detecteam-vs-elastic-security): Detecteam and Elastic Security compared on the same rubric and 33 capabilities: 20 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Google Security Operations: capability diff](https://detectionascode.com/diff/detecteam-vs-google-secops): Detecteam and Google Security Operations compared on the same rubric and 33 capabilities: 20 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Hunters: capability diff](https://detectionascode.com/diff/detecteam-vs-hunters): Detecteam and Hunters compared on the same rubric and 33 capabilities: 13 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Mate Security: capability diff](https://detectionascode.com/diff/detecteam-vs-mate-security): Detecteam and Mate Security compared on the same rubric and 33 capabilities: 8 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Microsoft Sentinel: capability diff](https://detectionascode.com/diff/detecteam-vs-microsoft-sentinel): Detecteam and Microsoft Sentinel compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Panther: capability diff](https://detectionascode.com/diff/detecteam-vs-panther): Detecteam and Panther compared on the same rubric and 33 capabilities: 23 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Sekoia.io: capability diff](https://detectionascode.com/diff/detecteam-vs-sekoia): Detecteam and Sekoia.io compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/detecteam-vs-sigma-pysigma): Detecteam and Sigma and pySigma compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs SOC Prime: capability diff](https://detectionascode.com/diff/detecteam-vs-soc-prime): Detecteam and SOC Prime compared on the same rubric and 33 capabilities: 9 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Detecteam vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/detecteam-vs-splunk-enterprise-security): Detecteam and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Google Security Operations: capability diff](https://detectionascode.com/diff/elastic-security-vs-google-secops): Elastic Security and Google Security Operations compared on the same rubric and 33 capabilities: 11 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Hunters: capability diff](https://detectionascode.com/diff/elastic-security-vs-hunters): Elastic Security and Hunters compared on the same rubric and 33 capabilities: 16 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Mate Security: capability diff](https://detectionascode.com/diff/elastic-security-vs-mate-security): Elastic Security and Mate Security compared on the same rubric and 33 capabilities: 20 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Microsoft Sentinel: capability diff](https://detectionascode.com/diff/elastic-security-vs-microsoft-sentinel): Elastic Security and Microsoft Sentinel compared on the same rubric and 33 capabilities: 13 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Panther: capability diff](https://detectionascode.com/diff/elastic-security-vs-panther): Elastic Security and Panther compared on the same rubric and 33 capabilities: 13 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Sekoia.io: capability diff](https://detectionascode.com/diff/elastic-security-vs-sekoia): Elastic Security and Sekoia.io compared on the same rubric and 33 capabilities: 19 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/elastic-security-vs-sigma-pysigma): Elastic Security and Sigma and pySigma compared on the same rubric and 33 capabilities: 22 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs SOC Prime: capability diff](https://detectionascode.com/diff/elastic-security-vs-soc-prime): Elastic Security and SOC Prime compared on the same rubric and 33 capabilities: 19 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Elastic Security vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/elastic-security-vs-splunk-enterprise-security): Elastic Security and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs Hunters: capability diff](https://detectionascode.com/diff/google-secops-vs-hunters): Google Security Operations and Hunters compared on the same rubric and 33 capabilities: 12 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs Mate Security: capability diff](https://detectionascode.com/diff/google-secops-vs-mate-security): Google Security Operations and Mate Security compared on the same rubric and 33 capabilities: 16 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs Microsoft Sentinel: capability diff](https://detectionascode.com/diff/google-secops-vs-microsoft-sentinel): Google Security Operations and Microsoft Sentinel compared on the same rubric and 33 capabilities: 12 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs Panther: capability diff](https://detectionascode.com/diff/google-secops-vs-panther): Google Security Operations and Panther compared on the same rubric and 33 capabilities: 13 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs Sekoia.io: capability diff](https://detectionascode.com/diff/google-secops-vs-sekoia): Google Security Operations and Sekoia.io compared on the same rubric and 33 capabilities: 13 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/google-secops-vs-sigma-pysigma): Google Security Operations and Sigma and pySigma compared on the same rubric and 33 capabilities: 22 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs SOC Prime: capability diff](https://detectionascode.com/diff/google-secops-vs-soc-prime): Google Security Operations and SOC Prime compared on the same rubric and 33 capabilities: 19 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Google Security Operations vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/google-secops-vs-splunk-enterprise-security): Google Security Operations and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 14 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Hunters vs Mate Security: capability diff](https://detectionascode.com/diff/hunters-vs-mate-security): Hunters and Mate Security compared on the same rubric and 33 capabilities: 7 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Hunters vs Microsoft Sentinel: capability diff](https://detectionascode.com/diff/hunters-vs-microsoft-sentinel): Hunters and Microsoft Sentinel compared on the same rubric and 33 capabilities: 13 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Hunters vs Panther: capability diff](https://detectionascode.com/diff/hunters-vs-panther): Hunters and Panther compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Hunters vs Sekoia.io: capability diff](https://detectionascode.com/diff/hunters-vs-sekoia): Hunters and Sekoia.io compared on the same rubric and 33 capabilities: 11 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Hunters vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/hunters-vs-sigma-pysigma): Hunters and Sigma and pySigma compared on the same rubric and 33 capabilities: 18 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Hunters vs SOC Prime: capability diff](https://detectionascode.com/diff/hunters-vs-soc-prime): Hunters and SOC Prime compared on the same rubric and 33 capabilities: 12 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Hunters vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/hunters-vs-splunk-enterprise-security): Hunters and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 16 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Mate Security vs Microsoft Sentinel: capability diff](https://detectionascode.com/diff/mate-security-vs-microsoft-sentinel): Mate Security and Microsoft Sentinel compared on the same rubric and 33 capabilities: 15 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Mate Security vs Panther: capability diff](https://detectionascode.com/diff/mate-security-vs-panther): Mate Security and Panther compared on the same rubric and 33 capabilities: 22 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Mate Security vs Sekoia.io: capability diff](https://detectionascode.com/diff/mate-security-vs-sekoia): Mate Security and Sekoia.io compared on the same rubric and 33 capabilities: 12 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Mate Security vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/mate-security-vs-sigma-pysigma): Mate Security and Sigma and pySigma compared on the same rubric and 33 capabilities: 18 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Mate Security vs SOC Prime: capability diff](https://detectionascode.com/diff/mate-security-vs-soc-prime): Mate Security and SOC Prime compared on the same rubric and 33 capabilities: 11 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Mate Security vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/mate-security-vs-splunk-enterprise-security): Mate Security and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 16 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Microsoft Sentinel vs Panther: capability diff](https://detectionascode.com/diff/microsoft-sentinel-vs-panther): Microsoft Sentinel and Panther compared on the same rubric and 33 capabilities: 11 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Microsoft Sentinel vs Sekoia.io: capability diff](https://detectionascode.com/diff/microsoft-sentinel-vs-sekoia): Microsoft Sentinel and Sekoia.io compared on the same rubric and 33 capabilities: 16 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Microsoft Sentinel vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/microsoft-sentinel-vs-sigma-pysigma): Microsoft Sentinel and Sigma and pySigma compared on the same rubric and 33 capabilities: 21 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Microsoft Sentinel vs SOC Prime: capability diff](https://detectionascode.com/diff/microsoft-sentinel-vs-soc-prime): Microsoft Sentinel and SOC Prime compared on the same rubric and 33 capabilities: 16 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Microsoft Sentinel vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/microsoft-sentinel-vs-splunk-enterprise-security): Microsoft Sentinel and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 18 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Panther vs Sekoia.io: capability diff](https://detectionascode.com/diff/panther-vs-sekoia): Panther and Sekoia.io compared on the same rubric and 33 capabilities: 16 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Panther vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/panther-vs-sigma-pysigma): Panther and Sigma and pySigma compared on the same rubric and 33 capabilities: 24 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Panther vs SOC Prime: capability diff](https://detectionascode.com/diff/panther-vs-soc-prime): Panther and SOC Prime compared on the same rubric and 33 capabilities: 20 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Panther vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/panther-vs-splunk-enterprise-security): Panther and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Sekoia.io vs Sigma and pySigma: capability diff](https://detectionascode.com/diff/sekoia-vs-sigma-pysigma): Sekoia.io and Sigma and pySigma compared on the same rubric and 33 capabilities: 19 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Sekoia.io vs SOC Prime: capability diff](https://detectionascode.com/diff/sekoia-vs-soc-prime): Sekoia.io and SOC Prime compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Sekoia.io vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/sekoia-vs-splunk-enterprise-security): Sekoia.io and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 14 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Sigma and pySigma vs SOC Prime: capability diff](https://detectionascode.com/diff/sigma-pysigma-vs-soc-prime): Sigma and pySigma and SOC Prime compared on the same rubric and 33 capabilities: 15 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Sigma and pySigma vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/sigma-pysigma-vs-splunk-enterprise-security): Sigma and pySigma and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 19 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [SOC Prime vs Splunk Enterprise Security (Cisco): capability diff](https://detectionascode.com/diff/soc-prime-vs-splunk-enterprise-security): SOC Prime and Splunk Enterprise Security (Cisco) compared on the same rubric and 33 capabilities: 17 rows differ, with the sourced difference that decides the pair and a verdict by buyer type. - [Head-to-heads: all 66 platform pairs as capability diffs](https://detectionascode.com/diff): Every pair of the twelve profiled platforms compared as a capability diff over 33 rows, with the sourced difference that decides the pair and a verdict by buyer type. ## Alternatives - [Alternatives to SOC Prime](https://detectionascode.com/alternatives/soc-prime): Where SOC Prime falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Anvilogic](https://detectionascode.com/alternatives/anvilogic): Where Anvilogic falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Panther](https://detectionascode.com/alternatives/panther): Where Panther falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Sigma and pySigma](https://detectionascode.com/alternatives/sigma-pysigma): Where Sigma and pySigma falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Detecteam](https://detectionascode.com/alternatives/detecteam): Where Detecteam falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Elastic Security](https://detectionascode.com/alternatives/elastic-security): Where Elastic Security falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Splunk Enterprise Security (Cisco)](https://detectionascode.com/alternatives/splunk-enterprise-security): Where Splunk Enterprise Security (Cisco) falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Sekoia.io](https://detectionascode.com/alternatives/sekoia): Where Sekoia.io falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Hunters](https://detectionascode.com/alternatives/hunters): Where Hunters falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Google Security Operations](https://detectionascode.com/alternatives/google-secops): Where Google Security Operations falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Microsoft Sentinel](https://detectionascode.com/alternatives/microsoft-sentinel): Where Microsoft Sentinel falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives to Mate Security](https://detectionascode.com/alternatives/mate-security): Where Mate Security falls short on public documentation, and which of the other eleven profiled detection platforms answer each gap, ordered by rubric total. - [Alternatives: one page per detection-as-code platform](https://detectionascode.com/alternatives): For each of the twelve profiled platforms, the gaps in its public documentation and the alternatives that answer them, ordered by the published rubric. ## By buyer - [Ranking for microsoft sentinel estate](https://detectionascode.com/for/sentinel-estate): A detection team already running Microsoft Sentinel that writes KQL analytics rules and wants a repository workflow, tests and proof that rules run. Twelve platforms ranked with this buyer type's weights, on the same published evidence. - [Ranking for elastic estate](https://detectionascode.com/for/elastic-estate): A team running Elastic Security that keeps rules as TOML in the detection-rules repository, or wants to, and cares most about knowing which rules are noisy or failing. Twelve platforms ranked with this buyer type's weights, on the same published evidence. - [Ranking for splunk estate](https://detectionascode.com/for/splunk-estate): A team running Splunk Enterprise Security with SPL detections, ESCU content and contentctl, deciding what to add as Splunk moves development to Detection Studio. Twelve platforms ranked with this buyer type's weights, on the same published evidence. - [Ranking for google secops estate](https://detectionascode.com/for/google-secops-estate): A team running Google Security Operations that writes YARA-L, uses the Rules API and the Content Manager CLI, and wants revisions and replay handled well. Twelve platforms ranked with this buyer type's weights, on the same published evidence. - [Ranking for a team starting detection as code from scratch with sigma](https://detectionascode.com/for/sigma-from-scratch): A small team with no SIEM lock-in that wants to write rules in Sigma, keep them in git and test them before they ship. Twelve platforms ranked with this buyer type's weights, on the same published evidence. - [Rankings by buyer type](https://detectionascode.com/for): The twelve detection-as-code platforms ranked with different weights for different buyers: SIEM-native teams, Splunk and Elastic shops, git-first teams and content buyers. ## Guides - [Choosing a rule language per estate](https://detectionascode.com/guides/choosing-a-rule-language-per-estate): Native rule language or Sigma? What KQL, SPL, YARA-L, EQL, ES|QL and Python rules each cost you, and how to choose by estate, with sourced limits. - [Converting Sigma with pySigma and what breaks](https://detectionascode.com/guides/converting-sigma-with-pysigma-and-what-breaks): How sigma-cli and pySigma convert Sigma to SPL, KQL and Elastic queries, which backends are stable, and six places a conversion quietly goes wrong. - [A detection-as-code pipeline from repository to SIEM](https://detectionascode.com/guides/detection-as-code-pipeline-repo-to-siem): How rules travel from a git repo to a SIEM: validate, test, review, deploy and verify, with the commands Panther, Elastic, Sentinel and Splunk document. - [Measuring ATT&CK coverage without fooling yourself](https://detectionascode.com/guides/measuring-attack-coverage-without-fooling-yourself): A tagged rule is not a working detection. How to count ATT&CK coverage so it survives scrutiny, and what Sentinel, Elastic and Panther document. - [A 30-day plan to move an existing rule set into git](https://detectionascode.com/guides/moving-an-existing-rule-set-into-git-in-30-days): A week-by-week plan to move rules from a SIEM console into git with validation, tests, a health baseline and a CI deploy, using documented exports. - [Rule health: noisy, silent, drifted and expensive rules](https://detectionascode.com/guides/rule-health-noisy-silent-drifted-expensive): Four ways a detection rule decays after it ships, and which platforms document a signal for each: Sentinel, Elastic, Google, Panther and Sekoia. - [Unit tests and replay for detection rules](https://detectionascode.com/guides/unit-tests-and-replay-for-detection-rules): Unit tests prove logic, replay proves behaviour on real data. What Panther, Splunk, Elastic, Google and Sentinel document for each, and the gaps. - [Versioning, rollback and environment promotion for rules](https://detectionascode.com/guides/versioning-rollback-and-promotion-for-rules): Git history is not enough when the SIEM holds the live copy. What Elastic, Google, Sentinel and Splunk document for rule history and rollback. - [Guides for detection engineers](https://detectionascode.com/guides): Guides on setting up a detection repository, testing detections, rule health, ATT&CK coverage and buying content, each with sourced facts and a checklist. ## Glossary - [ATT&CK coverage: glossary](https://detectionascode.com/glossary/attack-coverage): ATT&CK coverage in detection engineering: a short definition and a sourced example from Elastic Security documentation. - [Backtest: glossary](https://detectionascode.com/glossary/backtest): Backtest in detection engineering: a short definition and a sourced example from Sekoia documentation. - [CI pipeline: glossary](https://detectionascode.com/glossary/ci-pipeline): CI pipeline in detection engineering: a short definition and a sourced example from Panther documentation. - [Community rules: glossary](https://detectionascode.com/glossary/community-rules): Community rules in detection engineering: a short definition and a sourced example from Panther documentation. - [Content library: glossary](https://detectionascode.com/glossary/content-library): Content library in detection engineering: a short definition and a sourced example from Sekoia documentation. - [Coverage gap: glossary](https://detectionascode.com/glossary/coverage-gap): Coverage gap in detection engineering: a short definition and a sourced example from Hunters documentation. - [Data source coverage: glossary](https://detectionascode.com/glossary/data-source-coverage): Data source coverage in detection engineering: a short definition and a sourced example from Splunk Enterprise Security documentation. - [Deprecation: glossary](https://detectionascode.com/glossary/deprecation): Deprecation in detection engineering: a short definition and a sourced example from Sigma and pySigma documentation. - [Detection as code: glossary](https://detectionascode.com/glossary/detection-as-code): Detection as code in detection engineering: a short definition and a sourced example from Microsoft Sentinel documentation. - [Detection engineering: glossary](https://detectionascode.com/glossary/detection-engineering): Detection engineering in detection engineering: a short definition and a sourced example from Splunk Enterprise Security documentation. - [Detection repository: glossary](https://detectionascode.com/glossary/detection-repository): Detection repository in detection engineering: a short definition and a sourced example from Microsoft Sentinel documentation. - [Detection rule: glossary](https://detectionascode.com/glossary/detection-rule): Detection rule in detection engineering: a short definition and a sourced example from Elastic Security documentation. - [EQL: glossary](https://detectionascode.com/glossary/eql): EQL in detection engineering: a short definition and a sourced example from Sigma and pySigma documentation. - [ES|QL: glossary](https://detectionascode.com/glossary/esql): ES|QL in detection engineering: a short definition and a sourced example from Elastic Security documentation. - [ESCU: glossary](https://detectionascode.com/glossary/escu): ESCU in detection engineering: a short definition and a sourced example from Splunk Enterprise Security documentation. - [False positive rate: glossary](https://detectionascode.com/glossary/false-positive-rate): False positive rate in detection engineering: a short definition and a sourced example from Panther documentation. - [Field drift: glossary](https://detectionascode.com/glossary/field-drift): Field drift in detection engineering: a short definition and a sourced example from Cribl (CardinalOps) documentation. - [KQL: glossary](https://detectionascode.com/glossary/kql): KQL in detection engineering: a short definition and a sourced example from Microsoft Sentinel documentation. - [Log source health: glossary](https://detectionascode.com/glossary/log-source-health): Log source health in detection engineering: a short definition and a sourced example from Panther documentation. - [Noisy rule: glossary](https://detectionascode.com/glossary/noisy-rule): Noisy rule in detection engineering: a short definition and a sourced example from Google Security Operations documentation. - [Prebuilt rules: glossary](https://detectionascode.com/glossary/prebuilt-rules): Prebuilt rules in detection engineering: a short definition and a sourced example from Elastic Security documentation. - [Pull request workflow: glossary](https://detectionascode.com/glossary/pull-request-workflow): Pull request workflow in detection engineering: a short definition and a sourced example from Splunk Enterprise Security documentation. - [pySigma: glossary](https://detectionascode.com/glossary/pysigma): pySigma in detection engineering: a short definition and a sourced example from Sigma and pySigma documentation. - [Replay: glossary](https://detectionascode.com/glossary/replay): Replay in detection engineering: a short definition and a sourced example from Microsoft Sentinel documentation. - [Rollback: glossary](https://detectionascode.com/glossary/rollback): Rollback in detection engineering: a short definition and a sourced example from Microsoft Sentinel documentation. - [Rule health: glossary](https://detectionascode.com/glossary/rule-health): Rule health in detection engineering: a short definition and a sourced example from Microsoft Sentinel documentation. - [Rule lifecycle: glossary](https://detectionascode.com/glossary/rule-lifecycle): Rule lifecycle in detection engineering: a short definition and a sourced example from Sekoia documentation. - [Rule unit test: glossary](https://detectionascode.com/glossary/rule-unit-test): Rule unit test in detection engineering: a short definition and a sourced example from Panther documentation. - [Rule versioning: glossary](https://detectionascode.com/glossary/rule-versioning): Rule versioning in detection engineering: a short definition and a sourced example from Google Security Operations documentation. - [Schema change: glossary](https://detectionascode.com/glossary/schema-change): Schema change in detection engineering: a short definition and a sourced example from Panther documentation. - [Sigma: glossary](https://detectionascode.com/glossary/sigma): Sigma in detection engineering: a short definition and a sourced example from Sigma and pySigma documentation. - [Silent rule: glossary](https://detectionascode.com/glossary/silent-rule): Silent rule in detection engineering: a short definition and a sourced example from Elastic Security documentation. - [SPL: glossary](https://detectionascode.com/glossary/spl): SPL in detection engineering: a short definition and a sourced example from Splunk Enterprise Security documentation. - [Synthetic event: glossary](https://detectionascode.com/glossary/synthetic-event): Synthetic event in detection engineering: a short definition and a sourced example from Splunk Enterprise Security documentation. - [Tuning: glossary](https://detectionascode.com/glossary/tuning): Tuning in detection engineering: a short definition and a sourced example from Anvilogic documentation. - [YARA-L: glossary](https://detectionascode.com/glossary/yara-l): YARA-L in detection engineering: a short definition and a sourced example from Google Security Operations documentation. - [Glossary: 36 detection engineering terms](https://detectionascode.com/glossary): 36 terms from detection engineering and detection as code, each with a short definition and a sourced example from a named vendor's documentation. ## Changelog - [SOC Prime's news page lists five posts under one date](https://detectionascode.com/changelog/soc-prime-news-listing): SOC Prime's news page lists five posts under one date, dated 2026-11-03. Nothing in the workflow changes. The page is content marketing, and the library size and the daily cadence on the marketplace page remain vendor claims with no dates. - [Elastic Stack 9.5.6 appears on the Elastic blog](https://detectionascode.com/changelog/elastic-stack-9-5-6): Elastic Stack 9.5.6 appears on the Elastic blog, dated 2026-11-02. A team on 9.4 or earlier does not get the History view. Patch level does not change that, so the upgrade target is the 9.5 line. - [Newest detection on research.splunk.com is dated 2026-10-28](https://detectionascode.com/changelog/splunk-research-newest-detection): Newest detection on research.splunk.com is dated 2026-10-28, dated 2026-10-28. A Splunk team can treat the library as live, but should match a new detection to an ESCU release before assuming it is in its own instance. - [Google SecOps curated rules move to the GTI_IOC feed](https://detectionascode.com/changelog/google-secops-gti-ioc-curated-rules): Google SecOps curated rules move to the GTI_IOC feed, dated 2026-10-12. Search your rule repository for legacy feed references and update them, and add that search to the pipeline so the next feed change is caught in review. - [Elastic scores 1,781 prebuilt rules every month](https://detectionascode.com/changelog/elastic-prebuilt-rule-scoring): Elastic scores 1,781 prebuilt rules every month, dated 2026-10-05. Elastic buyers get a published noise signal for prebuilt rules, which the other docs read do not match. Replay the Recommended set on your own data before you rely on the tags. - [Google SecOps grok filter gains a match_all option](https://detectionascode.com/changelog/google-secops-grok-match-all): Google SecOps grok filter gains a match_all option, dated 2026-09-15. If you edit a parser, replay the rules that read its fields before and after. The release note adds a capability and carries no warning for existing rules. - [Splunk ESCU 6.6.0 adds 12 behavioral analytics and updates 18](https://detectionascode.com/changelog/splunk-escu-6-6-0): Splunk ESCU 6.6.0 adds 12 behavioral analytics and updates 18, dated 2026-09-10. A Splunk team should review the 18 updated analytics against the rules it has tuned, because an update can overwrite a local change. - [Splunk ESCU 6.5.0 adds 13 behavioral analytics and two stories](https://detectionascode.com/changelog/splunk-escu-6-5-0): Splunk ESCU 6.5.0 adds 13 behavioral analytics and two stories, dated 2026-08-27. If your pipeline builds content with contentctl, the 6.5.0 and 6.6.0 releases are the next two diffs to review. - [Mandiant Frontline Threats rule packs added to Google SecOps](https://detectionascode.com/changelog/google-secops-mandiant-rule-packs): Mandiant Frontline Threats rule packs added to Google SecOps, dated 2026-08-26. Teams with Linux, macOS or Google Cloud log sources have new curated content to enable. Replay it on your data first, since no rule count or tuning guidance is given. - [Google SecOps adds an Unroll processor to data pipelines](https://detectionascode.com/changelog/google-secops-unroll-processor): Google SecOps adds an Unroll processor to data pipelines, dated 2026-08-24. If you adopt Unroll, check threshold and match-window rules on the affected log types, because event counts can change. - [Sentinel's MITRE coverage doc updated, still in preview](https://detectionascode.com/changelog/sentinel-mitre-coverage-doc): Sentinel's MITRE coverage doc updated, still in preview, dated 2026-08-12. Use the matrix as a planning view and keep the preview label in any report. A filled cell shows a rule mapped to a technique, not a technique tested. - [Sentinel repositories doc: custom detection rules as code in preview](https://detectionascode.com/changelog/sentinel-repositories-doc): Sentinel repositories doc: custom detection rules as code in preview, dated 2026-08-08. Plan the repository around the Defender portal's custom detection rules, and treat the preview as subject to change before you move rules over. - [Changelog: dated notes on detection platforms](https://detectionascode.com/changelog): Dated notes on changes to detection-as-code platforms and their documentation, each with the source and what it changes for a buyer. ## FAQ - [FAQ: 30 questions on detection as code](https://detectionascode.com/faq): 30 questions and answers on detection engineering, detection as code, the rubric and the matrix. ## About - [About Detection as Code](https://detectionascode.com/about): A capability matrix and head-to-heads for detection engineering tooling, checked against public documentation. What the publication is and how it works. - [Editorial policy](https://detectionascode.com/editorial-policy): How scores are set from public documentation, how vendors can send corrections, and why vendors cannot pay to change a score. - [Corrections log](https://detectionascode.com/corrections): A dated log of corrections to scores, cells and text on Detection as Code, starting with the first publication. - [Contact](https://detectionascode.com/contact): Contact the editor at editor@detectionascode.com to send a correction, a source or a question about a score. - [Privacy](https://detectionascode.com/privacy): What the host analytics collects and what the site does not: no cookies are set by the site and no forms collect personal data. - [Terms of use](https://detectionascode.com/terms): Terms of use for Detection as Code: reference information read from public sources, the dataset licence and the limits of what the site claims.