Detection as Code

Library: 3 capabilities

Library is documented to 40 percent across the 14 platforms (documented counts 1, partial 0.5). The capabilities are Library count, Community, Cadence. Each row below gives the page that supports a documented or partial cell, with its read date.

Library columns only.
PlatformLibraryScore
Library countCommunityCadence
PantherPanther, Library count: partialpartialPanther, Community: documenteddocumentedPanther, Cadence: partialpartial2.0 / 3
Elastic SecurityElastic Security, Library count: partialpartialElastic Security, Community: partialpartialElastic Security, Cadence: partialpartial1.5 / 3
Google Security OperationsGoogle Security Operations, Library count: partialpartialGoogle Security Operations, Community: documenteddocumentedGoogle Security Operations, Cadence: partialpartial2.0 / 3
Splunk Enterprise Security (Cisco)Splunk Enterprise Security (Cisco), Library count: documenteddocumentedSplunk Enterprise Security (Cisco), Community: not documentednot documentedSplunk Enterprise Security (Cisco), Cadence: partialpartial1.5 / 3
Microsoft SentinelMicrosoft Sentinel, Library count: partialpartialMicrosoft Sentinel, Community: documenteddocumentedMicrosoft Sentinel, Cadence: not documentednot documented1.5 / 3
Sigma and pySigmaSigma and pySigma, Library count: documenteddocumentedSigma and pySigma, Community: documenteddocumentedSigma and pySigma, Cadence: partialpartial2.5 / 3
Sekoia.ioSekoia.io, Library count: documenteddocumentedSekoia.io, Community: not documentednot documentedSekoia.io, Cadence: partialpartial1.5 / 3
AnvilogicAnvilogic, Library count: partialpartialAnvilogic, Community: not documentednot documentedAnvilogic, Cadence: partialpartial1.0 / 3
HuntersHunters, Library count: partialpartialHunters, Community: not documentednot documentedHunters, Cadence: partialpartial1.0 / 3
SOC PrimeSOC Prime, Library count: partialpartialSOC Prime, Community: partialpartialSOC Prime, Cadence: partialpartial1.5 / 3
DetecteamDetecteam, Library count: partialpartialDetecteam, Community: not documentednot documentedDetecteam, Cadence: not documentednot documented0.5 / 3
Mate SecurityMate Security, Library count: partialpartialMate Security, Community: not documentednot documentedMate Security, Cadence: not documentednot documented0.5 / 3
CardinalOps (Cribl)no longer ships under this nameCardinalOps (Cribl), Library count: not documentednot documentedCardinalOps (Cribl), Community: not documentednot documentedCardinalOps (Cribl), Cadence: not documentednot documented0.0 / 3
SnapAttack (Cisco)no longer ships under this nameSnapAttack (Cisco), Library count: not documentednot documentedSnapAttack (Cisco), Community: not documentednot documentedSnapAttack (Cisco), Cadence: not documentednot documented0.0 / 3

documenteddocumentedpartialpartialnot documentednot documented

What each platform documents

Documented and partial cells with their notes and sources. A cell that names no feature is listed as not documented, which says only that the public pages read do not name it.

PlatformCells
Panther
  • Library count: partial Library count, partial. 'Using Panther-managed Detections' describes out-of-the-box Python detections; no count on page docs.panther.com read 2026-11-03
  • Community: documented Community, documented. panther-analysis README: all detections developed by the Panther Team and the Community, contributing guidelines raw.githubusercontent.com read 2026-11-03
  • Cadence: partial Cadence, partial. Panther 'periodically releases improvements' to managed detections; Content Catalog (Beta) updates; no cadence docs.panther.com read 2026-11-03
Elastic Security
  • Library count: partial Library count, partial. 'Prebuilt detection rules reference' lists every prebuilt rule; page states no total elastic.co read 2026-11-03
  • Community: partial Community, partial. detection-rules README has 'How to contribute'; repo is Elastic's own rule set raw.githubusercontent.com read 2026-11-03
  • Cadence: partial Cadence, partial. 'Elastic regularly updates prebuilt rules'; no cadence stated elastic.co read 2026-11-03
Google Security Operations
  • Library count: partial Library count, partial. 'Curated detections' rule sets by category; page read gives no total docs.cloud.google.com read 2026-11-03
  • Community: documented Community, documented. chronicle/detection-rules repo: rules/community holds 'YARA-L rules created by members of the Google SecOps team and user community' raw.githubusercontent.com read 2026-11-03
  • Cadence: partial Cadence, partial. Curated rule sets and new rules in existing sets update automatically; no cadence stated docs.cloud.google.com read 2026-11-03
Splunk Enterprise Security (Cisco)
  • Library count: documented Library count, documented. research.splunk.com states 2207 detections and over 2,000 production-ready detections research.splunk.com read 2026-11-03
  • Cadence: partial Cadence, partial. research.splunk.com shows 'Latest Update: v6.9.2'; ESCU update dialog in ES; no cadence stated research.splunk.com read 2026-11-03
Not documented: Community.
Microsoft Sentinel
  • Library count: partial Library count, partial. 'Content hub' solutions and standalone items; page states no total learn.microsoft.com read 2026-11-03
  • Community: documented Community, documented. Content hub: standalone items and solutions that community members can create and share learn.microsoft.com read 2026-11-03
Not documented: Cadence.
Sigma and pySigma
  • Library count: documented Library count, documented. Main repo 'offers more than 3000 detection rules' (SigmaHQ is not a vendor; counted as the maintained library) raw.githubusercontent.com read 2026-11-03
  • Community: documented Community, documented. Community-maintained repo with contribution guide and rule types raw.githubusercontent.com read 2026-11-03
  • Cadence: partial Cadence, partial. 'New rules are also released on a regular basis'; rule package releases on the release page raw.githubusercontent.com read 2026-11-03
Sekoia.io
  • Library count: documented Library count, documented. Sekoia Verified Rules: 'more than 1000 rules' docs.sekoia.com read 2026-11-03
  • Cadence: partial Cadence, partial. Verified rules 'continuously updated'; no cadence stated docs.sekoia.com read 2026-11-03
Not documented: Community.
Anvilogic
  • Library count: partial Library count, partial. 'Anvilogic Armory': '3,500+ detections for any SIEM and Data Lake' (vendor claim) anvilogic.com read 2026-11-03
  • Cadence: partial Cadence, partial. 'New content weekly, driven by trending threat intelligence' anvilogic.com read 2026-11-03
Not documented: Community.
Hunters
  • Library count: partial Library count, partial. 'a library of hundreds of detectors'; no number docs.hunters.ai read 2026-11-03
  • Cadence: partial Cadence, partial. 'continuously growing list'; no cadence docs.hunters.ai read 2026-11-03
Not documented: Community.
SOC Prime
  • Library count: partial Library count, partial. Marketplace page '750,000+ Detection rules'; platform page '1,000,000+ detections'; Prime Detect '20,000+' (counts differ by page) socprime.com read 2026-11-03
  • Community: partial Community, partial. Uncoder.IO and Roota open-source language are linked from the site; community rule contribution not described socprime.com read 2026-11-03
  • Cadence: partial Cadence, partial. Marketplace page: '50+ Rules added every day' socprime.com read 2026-11-03
Detecteam
  • Library count: partial Library count, partial. 'Massive Attack & Detection Library'; no count stated detecteam.com read 2026-11-03
Not documented: Community, Cadence.
Mate Security
  • Library count: partial Library count, partial. 'Adaptive Detection Engineering Library'; no count stated mate.security read 2026-11-03
Not documented: Community, Cadence.
CardinalOps (Cribl)Not documented: Library count, Community, Cadence.
SnapAttack (Cisco)Not documented: Library count, Community, Cadence.

Other groups: Languages, Source control and CI, Testing, Coverage analytics, Rule health. Back to the full matrix.