Detection as Code

Rule health: what each platform documents

Rules decay after they ship. A rule stops running, a field is renamed, a query gets expensive, or a rule floods the queue. This page records what each platform's public documentation says about finding those four failures, with the short phrase copied from the page where there is one. Rule health.

Four of the five matrix rule-health columns per platform, ordered by the count over all five (documented counts 1, partial 0.5). Status is read from the page at the link in each entry below.

PlatformNoisy rulesBroken or silent rulesField driftRule costAll five columns: documented / partial
Google Security OperationsGoogle Security Operations, noisy_rules: partialpartialGoogle Security Operations, broken_or_silent_rules: documenteddocumentedGoogle Security Operations, drifted_fields: not documentednot documentedGoogle Security Operations, expensive_rules: documenteddocumented3 / 1
Elastic SecurityElastic Security, noisy_rules: not documentednot documentedElastic Security, broken_or_silent_rules: documenteddocumentedElastic Security, drifted_fields: partialpartialElastic Security, expensive_rules: documenteddocumented2 / 2
Sekoia.ioSekoia.io, noisy_rules: partialpartialSekoia.io, broken_or_silent_rules: partialpartialSekoia.io, drifted_fields: not documentednot documentedSekoia.io, expensive_rules: partialpartial1 / 3
PantherPanther, noisy_rules: not documentednot documentedPanther, broken_or_silent_rules: documenteddocumentedPanther, drifted_fields: partialpartialPanther, expensive_rules: partialpartial1 / 2
Microsoft SentinelMicrosoft Sentinel, noisy_rules: not documentednot documentedMicrosoft Sentinel, broken_or_silent_rules: documenteddocumentedMicrosoft Sentinel, drifted_fields: not documentednot documentedMicrosoft Sentinel, expensive_rules: partialpartial1 / 1
Splunk Enterprise Security (Cisco)Splunk Enterprise Security (Cisco), noisy_rules: not documentednot documentedSplunk Enterprise Security (Cisco), broken_or_silent_rules: partialpartialSplunk Enterprise Security (Cisco), drifted_fields: not documentednot documentedSplunk Enterprise Security (Cisco), expensive_rules: not documentednot documented1 / 1
AnvilogicAnvilogic, noisy_rules: partialpartialAnvilogic, broken_or_silent_rules: partialpartialAnvilogic, drifted_fields: not documentednot documentedAnvilogic, expensive_rules: not documentednot documented0 / 3
Mate SecurityMate Security, noisy_rules: partialpartialMate Security, broken_or_silent_rules: partialpartialMate Security, drifted_fields: not documentednot documentedMate Security, expensive_rules: not documentednot documented0 / 3
CardinalOps (Cribl)CardinalOps (Cribl), noisy_rules: partialpartialCardinalOps (Cribl), broken_or_silent_rules: partialpartialCardinalOps (Cribl), drifted_fields: partialpartialCardinalOps (Cribl), expensive_rules: not documentednot documented0 / 3
Sigma and pySigmaSigma and pySigma, noisy_rules: not documentednot documentedSigma and pySigma, broken_or_silent_rules: not documentednot documentedSigma and pySigma, drifted_fields: not documentednot documentedSigma and pySigma, expensive_rules: not documentednot documented1 / 0
HuntersHunters, noisy_rules: partialpartialHunters, broken_or_silent_rules: not documentednot documentedHunters, drifted_fields: not documentednot documentedHunters, expensive_rules: not documentednot documented0 / 2
DetecteamDetecteam, noisy_rules: not documentednot documentedDetecteam, broken_or_silent_rules: not documentednot documentedDetecteam, drifted_fields: not documentednot documentedDetecteam, expensive_rules: not documentednot documented0 / 0
SOC PrimeSOC Prime, noisy_rules: not documentednot documentedSOC Prime, broken_or_silent_rules: not documentednot documentedSOC Prime, drifted_fields: not documentednot documentedSOC Prime, expensive_rules: not documentednot documented0 / 0
SnapAttack (Cisco)SnapAttack (Cisco), noisy_rules: not documentednot documentedSnapAttack (Cisco), broken_or_silent_rules: not documentednot documentedSnapAttack (Cisco), drifted_fields: not documentednot documentedSnapAttack (Cisco), expensive_rules: not documentednot documented0 / 0

documenteddocumentedpartialpartialnot documentednot documented

The matrix rule-health group also carries lifecycle states, which this page does not repeat. All 5 columns are in the full matrix.

The matrix columns for rule health

Rule-health group of the matrix, platforms ordered by the same count.
PlatformRule healthScore
Noisy rulesBroken rulesField driftRule costLifecycle
Google Security OperationsGoogle Security Operations, Noisy rules: partialpartialGoogle Security Operations, Broken rules: documenteddocumentedGoogle Security Operations, Field drift: not documentednot documentedGoogle Security Operations, Rule cost: documenteddocumentedGoogle Security Operations, Lifecycle: documenteddocumented3.5 / 5
Elastic SecurityElastic Security, Noisy rules: not documentednot documentedElastic Security, Broken rules: documenteddocumentedElastic Security, Field drift: partialpartialElastic Security, Rule cost: documenteddocumentedElastic Security, Lifecycle: partialpartial3.0 / 5
Sekoia.ioSekoia.io, Noisy rules: partialpartialSekoia.io, Broken rules: partialpartialSekoia.io, Field drift: not documentednot documentedSekoia.io, Rule cost: partialpartialSekoia.io, Lifecycle: documenteddocumented2.5 / 5
PantherPanther, Noisy rules: not documentednot documentedPanther, Broken rules: documenteddocumentedPanther, Field drift: partialpartialPanther, Rule cost: partialpartialPanther, Lifecycle: not documentednot documented2.0 / 5
Microsoft SentinelMicrosoft Sentinel, Noisy rules: not documentednot documentedMicrosoft Sentinel, Broken rules: documenteddocumentedMicrosoft Sentinel, Field drift: not documentednot documentedMicrosoft Sentinel, Rule cost: partialpartialMicrosoft Sentinel, Lifecycle: not documentednot documented1.5 / 5
Splunk Enterprise Security (Cisco)Splunk Enterprise Security (Cisco), Noisy rules: not documentednot documentedSplunk Enterprise Security (Cisco), Broken rules: partialpartialSplunk Enterprise Security (Cisco), Field drift: not documentednot documentedSplunk Enterprise Security (Cisco), Rule cost: not documentednot documentedSplunk Enterprise Security (Cisco), Lifecycle: documenteddocumented1.5 / 5
AnvilogicAnvilogic, Noisy rules: partialpartialAnvilogic, Broken rules: partialpartialAnvilogic, Field drift: not documentednot documentedAnvilogic, Rule cost: not documentednot documentedAnvilogic, Lifecycle: partialpartial1.5 / 5
Mate SecurityMate Security, Noisy rules: partialpartialMate Security, Broken rules: partialpartialMate Security, Field drift: not documentednot documentedMate Security, Rule cost: not documentednot documentedMate Security, Lifecycle: partialpartial1.5 / 5
CardinalOps (Cribl)no longer ships under this nameCardinalOps (Cribl), Noisy rules: partialpartialCardinalOps (Cribl), Broken rules: partialpartialCardinalOps (Cribl), Field drift: partialpartialCardinalOps (Cribl), Rule cost: not documentednot documentedCardinalOps (Cribl), Lifecycle: not documentednot documented1.5 / 5
Sigma and pySigmaSigma and pySigma, Noisy rules: not documentednot documentedSigma and pySigma, Broken rules: not documentednot documentedSigma and pySigma, Field drift: not documentednot documentedSigma and pySigma, Rule cost: not documentednot documentedSigma and pySigma, Lifecycle: documenteddocumented1.0 / 5
HuntersHunters, Noisy rules: partialpartialHunters, Broken rules: not documentednot documentedHunters, Field drift: not documentednot documentedHunters, Rule cost: not documentednot documentedHunters, Lifecycle: partialpartial1.0 / 5
DetecteamDetecteam, Noisy rules: not documentednot documentedDetecteam, Broken rules: not documentednot documentedDetecteam, Field drift: not documentednot documentedDetecteam, Rule cost: not documentednot documentedDetecteam, Lifecycle: not documentednot documented0.0 / 5
SOC PrimeSOC Prime, Noisy rules: not documentednot documentedSOC Prime, Broken rules: not documentednot documentedSOC Prime, Field drift: not documentednot documentedSOC Prime, Rule cost: not documentednot documentedSOC Prime, Lifecycle: not documentednot documented0.0 / 5
SnapAttack (Cisco)no longer ships under this nameSnapAttack (Cisco), Noisy rules: not documentednot documentedSnapAttack (Cisco), Broken rules: not documentednot documentedSnapAttack (Cisco), Field drift: not documentednot documentedSnapAttack (Cisco), Rule cost: not documentednot documentedSnapAttack (Cisco), Lifecycle: not documentednot documented0.0 / 5

Quotes and sources by platform

Quotes are short phrases copied from the page at the link, read 2026-11-03. A banned or marketing word inside a quote is the vendor's, not this site's.

Google Security Operations 3 documented, 1 partial of 5 matrix rule-health columns

Adjacent evidence: Adjacent: the performance page lists 'Log source parsing issues (for example, delays in UDM normalization)' as a cause of detection delay.

Not documented: No field or schema drift alert tied to rules; noisy-rule handling is tuning guidance plus detection counts, not an automatic flag.

Elastic Security 2 documented, 2 partial of 5 matrix rule-health columns

Adjacent evidence: Gap tracking: 'How much source event time was not searched between this run and the previous execution' (Rule Monitoring, gap duration) at the same monitoring page.

Not documented: No noisy-rule flag; no alert when a field a rule uses stops appearing; the Data Quality dashboard checks ECS mapping of indices, not rule fields; no per-rule cost figure beyond execution duration.

Sekoia.io 1 documented, 3 partial of 5 matrix rule-health columns

Not documented: No failed-rule alerting, field drift alert or per-rule runtime telemetry on pages read. Rule lifecycle states (Scheduled for Deprecation, Deprecated) are documented but describe maintenance, not health.

Panther 1 documented, 2 partial of 5 matrix rule-health columns

Not documented: No noisy-rule detection; log classification errors cover logs that fail schemas, not fields a rule depends on; benchmark runs before deploy, no runtime cost telemetry on pages read.

Microsoft Sentinel 1 documented, 1 partial of 5 matrix rule-health columns

Adjacent evidence: SentinelHealth also records 'How many events the rule's query captured' per run and supports a query for auto-disabled scheduled rules.

Not documented: No noisy-rule detection and no field drift alert on pages read; health data is a log table to query, with no cost figure per rule.

Splunk Enterprise Security (Cisco) 1 documented, 1 partial of 5 matrix rule-health columns

Adjacent evidence: Detection Studio is a product page; the ES reference docs read describe detection versioning and periodic review to 'customize and deprecate detections' but no failed-search monitoring.

Not documented: No noisy-rule detection, drift alert or per-rule cost telemetry on pages read. contentctl README says investment is shifting to Detection Studio.

Anvilogic 0 documented, 3 partial of 5 matrix rule-health columns

Not documented: Product pages only; docs.anvilogic.com sits behind a login. The 80 percent figure is a vendor claim with no method; no drift or cost telemetry described.

Mate Security 0 documented, 3 partial of 5 matrix rule-health columns

Adjacent evidence: Platform page: 'Cut the noise, turn blind spots into detections.'

Not documented: The page names tuning, health and coverage as a use case but does not say how a noisy, broken or drifted rule is found, what the signals are, or how a rule is deprecated; no documentation portal found.

CardinalOps (Cribl) 0 documented, 3 partial of 5 matrix rule-health columns

Adjacent evidence: The 13 percent broken-rule figure is CardinalOps research quoted by Cribl; sample and method were not on the page. Tuning workflows 'find and fix broken, noisy SIEM detection rules as telemetry sources evolve and configurations drift' (solution brief, 2026-07-23).

Not documented: The deepest health vocabulary of any platform read, but only in press release, blog and brief; no product documentation was found after the move to cribl.io; no cost telemetry described.

Sigma and pySigma 1 documented, 0 partial of 5 matrix rule-health columns

Adjacent evidence: Adjacent: the rule status 'experimental' is defined as a rule that 'could lead to false positives results or be noisy'.

Not documented: A rule format and converter, so no runtime monitoring exists to document; no broken, drift or cost signals.

Hunters 0 documented, 2 partial of 5 matrix rule-health columns

Adjacent evidence: Data flows: each data flow 'is routinely monitored to ensure a continuous flow of data' (data health, not rule health).

Not documented: No broken-rule, drift or cost telemetry for detectors on pages read.

Detecteam 0 documented, 0 partial of 5 matrix rule-health columns

Not documented: Validation framing (what detections miss) rather than rule monitoring; no noisy, drift or cost telemetry described.

SOC Prime 0 documented, 0 partial of 5 matrix rule-health columns

Not documented: Marketing pages say rules are 'low-noise' but name no noisy, broken, drift or cost feature. docs.socprime.com did not resolve from this session.

SnapAttack (Cisco) 0 documented, 0 partial of 5 matrix rule-health columns

Not documented: snapattack.com redirects to the Splunk Enterprise Security product page; nothing about SnapAttack rule health could be read.