Detection as Code

Languages: 10 capabilities

Languages is documented to 13 percent across the 14 platforms (documented counts 1, partial 0.5). The capabilities are Sigma native, Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like. Each row below gives the page that supports a documented or partial cell, with its read date.

Languages columns only.
PlatformLanguagesScore
Sigma nativeSigma conversionYARA-LSPLKQLEQL or ES|QLPythonVisual builderYARALucene or KQL-like
PantherPanther, Sigma native: not documentednot documentedPanther, Sigma conversion: documenteddocumentedPanther, YARA-L: not documentednot documentedPanther, SPL: not documentednot documentedPanther, KQL: not documentednot documentedPanther, EQL or ES|QL: not documentednot documentedPanther, Python: documenteddocumentedPanther, Visual builder: documenteddocumentedPanther, YARA: not documentednot documentedPanther, Lucene or KQL-like: partialpartial3.5 / 10
Elastic SecurityElastic Security, Sigma native: not documentednot documentedElastic Security, Sigma conversion: not documentednot documentedElastic Security, YARA-L: not documentednot documentedElastic Security, SPL: not documentednot documentedElastic Security, KQL: not documentednot documentedElastic Security, EQL or ES|QL: documenteddocumentedElastic Security, Python: not documentednot documentedElastic Security, Visual builder: not documentednot documentedElastic Security, YARA: not documentednot documentedElastic Security, Lucene or KQL-like: documenteddocumented2.0 / 10
Google Security OperationsGoogle Security Operations, Sigma native: not documentednot documentedGoogle Security Operations, Sigma conversion: not documentednot documentedGoogle Security Operations, YARA-L: documenteddocumentedGoogle Security Operations, SPL: not documentednot documentedGoogle Security Operations, KQL: not documentednot documentedGoogle Security Operations, EQL or ES|QL: not documentednot documentedGoogle Security Operations, Python: not documentednot documentedGoogle Security Operations, Visual builder: not documentednot documentedGoogle Security Operations, YARA: not documentednot documentedGoogle Security Operations, Lucene or KQL-like: not documentednot documented1.0 / 10
Splunk Enterprise Security (Cisco)Splunk Enterprise Security (Cisco), Sigma native: not documentednot documentedSplunk Enterprise Security (Cisco), Sigma conversion: not documentednot documentedSplunk Enterprise Security (Cisco), YARA-L: not documentednot documentedSplunk Enterprise Security (Cisco), SPL: documenteddocumentedSplunk Enterprise Security (Cisco), KQL: not documentednot documentedSplunk Enterprise Security (Cisco), EQL or ES|QL: not documentednot documentedSplunk Enterprise Security (Cisco), Python: not documentednot documentedSplunk Enterprise Security (Cisco), Visual builder: not documentednot documentedSplunk Enterprise Security (Cisco), YARA: not documentednot documentedSplunk Enterprise Security (Cisco), Lucene or KQL-like: not documentednot documented1.0 / 10
Microsoft SentinelMicrosoft Sentinel, Sigma native: not documentednot documentedMicrosoft Sentinel, Sigma conversion: not documentednot documentedMicrosoft Sentinel, YARA-L: not documentednot documentedMicrosoft Sentinel, SPL: not documentednot documentedMicrosoft Sentinel, KQL: documenteddocumentedMicrosoft Sentinel, EQL or ES|QL: not documentednot documentedMicrosoft Sentinel, Python: not documentednot documentedMicrosoft Sentinel, Visual builder: not documentednot documentedMicrosoft Sentinel, YARA: not documentednot documentedMicrosoft Sentinel, Lucene or KQL-like: not documentednot documented1.0 / 10
Sigma and pySigmaSigma and pySigma, Sigma native: documenteddocumentedSigma and pySigma, Sigma conversion: documenteddocumentedSigma and pySigma, YARA-L: partialpartialSigma and pySigma, SPL: documenteddocumentedSigma and pySigma, KQL: documenteddocumentedSigma and pySigma, EQL or ES|QL: documenteddocumentedSigma and pySigma, Python: not documentednot documentedSigma and pySigma, Visual builder: not documentednot documentedSigma and pySigma, YARA: not documentednot documentedSigma and pySigma, Lucene or KQL-like: documenteddocumented6.5 / 10
Sekoia.ioSekoia.io, Sigma native: documenteddocumentedSekoia.io, Sigma conversion: not documentednot documentedSekoia.io, YARA-L: not documentednot documentedSekoia.io, SPL: not documentednot documentedSekoia.io, KQL: not documentednot documentedSekoia.io, EQL or ES|QL: not documentednot documentedSekoia.io, Python: not documentednot documentedSekoia.io, Visual builder: not documentednot documentedSekoia.io, YARA: not documentednot documentedSekoia.io, Lucene or KQL-like: partialpartial1.5 / 10
AnvilogicAnvilogic, Sigma native: not documentednot documentedAnvilogic, Sigma conversion: not documentednot documentedAnvilogic, YARA-L: not documentednot documentedAnvilogic, SPL: not documentednot documentedAnvilogic, KQL: not documentednot documentedAnvilogic, EQL or ES|QL: not documentednot documentedAnvilogic, Python: not documentednot documentedAnvilogic, Visual builder: partialpartialAnvilogic, YARA: not documentednot documentedAnvilogic, Lucene or KQL-like: not documentednot documented0.5 / 10
HuntersHunters, Sigma native: not documentednot documentedHunters, Sigma conversion: not documentednot documentedHunters, YARA-L: not documentednot documentedHunters, SPL: not documentednot documentedHunters, KQL: not documentednot documentedHunters, EQL or ES|QL: not documentednot documentedHunters, Python: not documentednot documentedHunters, Visual builder: partialpartialHunters, YARA: not documentednot documentedHunters, Lucene or KQL-like: not documentednot documented0.5 / 10
SOC PrimeSOC Prime, Sigma native: partialpartialSOC Prime, Sigma conversion: partialpartialSOC Prime, YARA-L: not documentednot documentedSOC Prime, SPL: not documentednot documentedSOC Prime, KQL: not documentednot documentedSOC Prime, EQL or ES|QL: not documentednot documentedSOC Prime, Python: not documentednot documentedSOC Prime, Visual builder: not documentednot documentedSOC Prime, YARA: not documentednot documentedSOC Prime, Lucene or KQL-like: not documentednot documented1.0 / 10
DetecteamDetecteam, Sigma native: not documentednot documentedDetecteam, Sigma conversion: not documentednot documentedDetecteam, YARA-L: not documentednot documentedDetecteam, SPL: not documentednot documentedDetecteam, KQL: not documentednot documentedDetecteam, EQL or ES|QL: not documentednot documentedDetecteam, Python: not documentednot documentedDetecteam, Visual builder: not documentednot documentedDetecteam, YARA: not documentednot documentedDetecteam, Lucene or KQL-like: not documentednot documented0.0 / 10
Mate SecurityMate Security, Sigma native: not documentednot documentedMate Security, Sigma conversion: not documentednot documentedMate Security, YARA-L: not documentednot documentedMate Security, SPL: not documentednot documentedMate Security, KQL: not documentednot documentedMate Security, EQL or ES|QL: not documentednot documentedMate Security, Python: not documentednot documentedMate Security, Visual builder: not documentednot documentedMate Security, YARA: not documentednot documentedMate Security, Lucene or KQL-like: not documentednot documented0.0 / 10
CardinalOps (Cribl)no longer ships under this nameCardinalOps (Cribl), Sigma native: not documentednot documentedCardinalOps (Cribl), Sigma conversion: not documentednot documentedCardinalOps (Cribl), YARA-L: not documentednot documentedCardinalOps (Cribl), SPL: not documentednot documentedCardinalOps (Cribl), KQL: not documentednot documentedCardinalOps (Cribl), EQL or ES|QL: not documentednot documentedCardinalOps (Cribl), Python: not documentednot documentedCardinalOps (Cribl), Visual builder: not documentednot documentedCardinalOps (Cribl), YARA: not documentednot documentedCardinalOps (Cribl), Lucene or KQL-like: not documentednot documented0.0 / 10
SnapAttack (Cisco)no longer ships under this nameSnapAttack (Cisco), Sigma native: not documentednot documentedSnapAttack (Cisco), Sigma conversion: not documentednot documentedSnapAttack (Cisco), YARA-L: not documentednot documentedSnapAttack (Cisco), SPL: not documentednot documentedSnapAttack (Cisco), KQL: not documentednot documentedSnapAttack (Cisco), EQL or ES|QL: not documentednot documentedSnapAttack (Cisco), Python: not documentednot documentedSnapAttack (Cisco), Visual builder: not documentednot documentedSnapAttack (Cisco), YARA: not documentednot documentedSnapAttack (Cisco), Lucene or KQL-like: not documentednot documented0.0 / 10

documenteddocumentedpartialpartialnot documentednot documented

What each platform documents

Documented and partial cells with their notes and sources. A cell that names no feature is listed as not documented, which says only that the public pages read do not name it.

PlatformCells
Panther
  • Sigma conversion: documented Sigma conversion, documented. 'Converting Sigma Rules': sigma-cli converts Sigma rules to Panther Simple or Python detections docs.panther.com read 2026-11-03
  • Python: documented Python, documented. 'Writing Python Detections'; rules, policies and scheduled rules docs.panther.com read 2026-11-03
  • Visual builder: documented Visual builder, documented. 'Using the Simple Detection Builder' and 'AI Detection Builder (Beta)' in the Console docs.panther.com read 2026-11-03
  • Lucene or KQL-like: partial Lucene or KQL-like, partial. 'PantherFlow (Beta)' is a pipelined query language for search; detection use not confirmed docs.panther.com read 2026-11-03
Not documented: Sigma native, YARA-L, SPL, KQL, EQL or ES|QL, YARA.
Elastic Security
  • EQL or ES|QL: documented EQL or ES|QL, documented. Rule types 'Event correlation (EQL)' and 'ES|QL' elastic.co read 2026-11-03
  • Lucene or KQL-like: documented Lucene or KQL-like, documented. 'Custom query' rules match events using KQL or Lucene elastic.co read 2026-11-03
Not documented: Sigma native, Sigma conversion, YARA-L, SPL, KQL, Python, Visual builder, YARA.
Google Security Operations
  • YARA-L: documented YARA-L, documented. 'Rules Editor' for YARA-L 2.0 rules; 'Generate YARA-L with Gemini' docs.cloud.google.com read 2026-11-03
Not documented: Sigma native, Sigma conversion, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.
Splunk Enterprise Security (Cisco)
  • SPL: documented SPL, documented. Detections are 'scheduled correlation searches' in SPL; ESCU ships 'Splunk searches' help.splunk.com read 2026-11-03
Not documented: Sigma native, Sigma conversion, YARA-L, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.
Microsoft Sentinel
  • KQL: documented KQL, documented. Analytics rules are KQL queries ('Build and test your queries in the Logs screen') learn.microsoft.com read 2026-11-03
Not documented: Sigma native, Sigma conversion, YARA-L, SPL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.
Sigma and pySigma
  • Sigma native: documented Sigma native, documented. Sigma rule format and 'Sigma Rules Specification', including 'Correlations' sigmahq.io read 2026-11-03
  • Sigma conversion: documented Sigma conversion, documented. pySigma 'Converting Sigma Rules into Queries'; sigma-cli 'sigma convert -t splunk' sigmahq-pysigma.readthedocs.io read 2026-11-03
  • YARA-L: partial YARA-L, partial. Google SecOps backend converts to 'UDM searches and YARA-L 2.0 detection rules'; listed with status Development sigmahq.io read 2026-11-03
  • SPL: documented SPL, documented. Splunk backend listed under Backends sigmahq.io read 2026-11-03
  • KQL: documented KQL, documented. 'Kusto' backend: Kusto Query Language (KQL) backend, status Stable sigmahq.io read 2026-11-03
  • EQL or ES|QL: documented EQL or ES|QL, documented. Elasticsearch backend converts to 'Lucene, ES|QL (with correlations) and EQL queries' sigmahq.io read 2026-11-03
  • Lucene or KQL-like: documented Lucene or KQL-like, documented. Elasticsearch backend outputs Lucene queries sigmahq.io read 2026-11-03
Not documented: Python, Visual builder, YARA.
Sekoia.io
  • Sigma native: documented Sigma native, documented. 'Sigma Rules' page: native Sigma YAML, including event_count, value_count and temporal correlation docs.sekoia.com read 2026-11-03
  • Lucene or KQL-like: partial Lucene or KQL-like, partial. 'SOL' (Sekoia Operating Language) queries run as scheduled detection rules; syntax relation to KQL not stated docs.sekoia.com read 2026-11-03
Not documented: Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA.
Anvilogic
  • Visual builder: partial Visual builder, partial. 'reusable, low-code detection components'; Blueprints drag-and-drop workflows (product page) anvilogic.com read 2026-11-03
Not documented: Sigma native, Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, YARA, Lucene or KQL-like.
Hunters
  • Visual builder: partial Visual builder, partial. 'Create a custom detector': guided Filter and Group By detector modes with 'Test logic'; not described as no-code docs.hunters.ai read 2026-11-03
Not documented: Sigma native, Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, YARA, Lucene or KQL-like.
SOC Prime
  • Sigma native: partial Sigma native, partial. Prime Detect 'Applies Sigma rules to streaming events' (product page) socprime.com read 2026-11-03
  • Sigma conversion: partial Sigma conversion, partial. Prime Architect: 'Convert Sigma rules into 48 SIEM and platform languages'; platform page says 65 'Sigma translation languages' (counts differ) socprime.com read 2026-11-03
Not documented: YARA-L, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.
DetecteamNot documented: Sigma native, Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.
Mate SecurityNot documented: Sigma native, Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.
CardinalOps (Cribl)Not documented: Sigma native, Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.
SnapAttack (Cisco)Not documented: Sigma native, Sigma conversion, YARA-L, SPL, KQL, EQL or ES|QL, Python, Visual builder, YARA, Lucene or KQL-like.

Other groups: Source control and CI, Testing, Coverage analytics, Rule health, Library. Back to the full matrix.