Detection as Code

Source control and CI: 6 capabilities

Source control and CI is documented to 30 percent across the 14 platforms (documented counts 1, partial 0.5). The capabilities are Git sync, PR deploy, CLI, Rule API, CI examples, Env promotion. Each row below gives the page that supports a documented or partial cell, with its read date.

Source control and CI columns only.
PlatformSource control and CIScore
Git syncPR deployCLIRule APICI examplesEnv promotion
PantherPanther, Git sync: documenteddocumentedPanther, PR deploy: documenteddocumentedPanther, CLI: documenteddocumentedPanther, Rule API: documenteddocumentedPanther, CI examples: documenteddocumentedPanther, Env promotion: not documentednot documented5.0 / 6
Elastic SecurityElastic Security, Git sync: documenteddocumentedElastic Security, PR deploy: partialpartialElastic Security, CLI: documenteddocumentedElastic Security, Rule API: documenteddocumentedElastic Security, CI examples: partialpartialElastic Security, Env promotion: partialpartial4.5 / 6
Google Security OperationsGoogle Security Operations, Git sync: documenteddocumentedGoogle Security Operations, PR deploy: partialpartialGoogle Security Operations, CLI: documenteddocumentedGoogle Security Operations, Rule API: documenteddocumentedGoogle Security Operations, CI examples: not documentednot documentedGoogle Security Operations, Env promotion: not documentednot documented3.5 / 6
Splunk Enterprise Security (Cisco)Splunk Enterprise Security (Cisco), Git sync: documenteddocumentedSplunk Enterprise Security (Cisco), PR deploy: partialpartialSplunk Enterprise Security (Cisco), CLI: documenteddocumentedSplunk Enterprise Security (Cisco), Rule API: not documentednot documentedSplunk Enterprise Security (Cisco), CI examples: documenteddocumentedSplunk Enterprise Security (Cisco), Env promotion: not documentednot documented3.5 / 6
Microsoft SentinelMicrosoft Sentinel, Git sync: documenteddocumentedMicrosoft Sentinel, PR deploy: documenteddocumentedMicrosoft Sentinel, CLI: not documentednot documentedMicrosoft Sentinel, Rule API: documenteddocumentedMicrosoft Sentinel, CI examples: documenteddocumentedMicrosoft Sentinel, Env promotion: partialpartial4.5 / 6
Sigma and pySigmaSigma and pySigma, Git sync: not documentednot documentedSigma and pySigma, PR deploy: not documentednot documentedSigma and pySigma, CLI: partialpartialSigma and pySigma, Rule API: not documentednot documentedSigma and pySigma, CI examples: partialpartialSigma and pySigma, Env promotion: not documentednot documented1.0 / 6
Sekoia.ioSekoia.io, Git sync: not documentednot documentedSekoia.io, PR deploy: not documentednot documentedSekoia.io, CLI: not documentednot documentedSekoia.io, Rule API: documenteddocumentedSekoia.io, CI examples: not documentednot documentedSekoia.io, Env promotion: not documentednot documented1.0 / 6
AnvilogicAnvilogic, Git sync: not documentednot documentedAnvilogic, PR deploy: not documentednot documentedAnvilogic, CLI: not documentednot documentedAnvilogic, Rule API: not documentednot documentedAnvilogic, CI examples: not documentednot documentedAnvilogic, Env promotion: partialpartial0.5 / 6
HuntersHunters, Git sync: not documentednot documentedHunters, PR deploy: not documentednot documentedHunters, CLI: not documentednot documentedHunters, Rule API: not documentednot documentedHunters, CI examples: not documentednot documentedHunters, Env promotion: not documentednot documented0.0 / 6
SOC PrimeSOC Prime, Git sync: partialpartialSOC Prime, PR deploy: not documentednot documentedSOC Prime, CLI: not documentednot documentedSOC Prime, Rule API: not documentednot documentedSOC Prime, CI examples: partialpartialSOC Prime, Env promotion: not documentednot documented1.0 / 6
DetecteamDetecteam, Git sync: not documentednot documentedDetecteam, PR deploy: not documentednot documentedDetecteam, CLI: not documentednot documentedDetecteam, Rule API: not documentednot documentedDetecteam, CI examples: partialpartialDetecteam, Env promotion: not documentednot documented0.5 / 6
Mate SecurityMate Security, Git sync: not documentednot documentedMate Security, PR deploy: not documentednot documentedMate Security, CLI: not documentednot documentedMate Security, Rule API: not documentednot documentedMate Security, CI examples: not documentednot documentedMate Security, Env promotion: not documentednot documented0.0 / 6
CardinalOps (Cribl)no longer ships under this nameCardinalOps (Cribl), Git sync: not documentednot documentedCardinalOps (Cribl), PR deploy: not documentednot documentedCardinalOps (Cribl), CLI: not documentednot documentedCardinalOps (Cribl), Rule API: not documentednot documentedCardinalOps (Cribl), CI examples: not documentednot documentedCardinalOps (Cribl), Env promotion: not documentednot documented0.0 / 6
SnapAttack (Cisco)no longer ships under this nameSnapAttack (Cisco), Git sync: not documentednot documentedSnapAttack (Cisco), PR deploy: not documentednot documentedSnapAttack (Cisco), CLI: not documentednot documentedSnapAttack (Cisco), Rule API: not documentednot documentedSnapAttack (Cisco), CI examples: not documentednot documentedSnapAttack (Cisco), Env promotion: not documentednot documented0.0 / 6

documenteddocumentedpartialpartialnot documentednot documented

What each platform documents

Documented and partial cells with their notes and sources. A cell that names no feature is listed as not documented, which says only that the public pages read do not name it.

PlatformCells
Panther
  • Git sync: documented Git sync, documented. 'Using panther-analysis' repo setup and 'Setting Up the Panther GitHub App (Beta)' docs.panther.com read 2026-11-03
  • PR deploy: documented PR deploy, documented. 'Managing Panther Content via GitHub Actions': automate testing and upload from the repo to the Console docs.panther.com read 2026-11-03
  • CLI: documented CLI, documented. Panther Analysis Tool commands test, validate, zip, upload, delete docs.panther.com read 2026-11-03
  • Rule API: documented Rule API, documented. PAT upload and delete use the Panther API; API token required in the CI workflow docs.panther.com read 2026-11-03
  • CI examples: documented CI examples, documented. Workflow YAML for GitHub Actions and CircleCI; no GitLab CI page in the docs index docs.panther.com read 2026-11-03
Not documented: Env promotion.
Elastic Security
  • Git sync: documented Git sync, documented. DaC reference: 'Git Sync' between local repo and the VCS, using the detection-rules repo dac-reference.readthedocs.io read 2026-11-03
  • PR deploy: partial PR deploy, partial. DaC reference describes 'CI/CD Sync via APIs' and peer review practice; no PR-triggered deploy workflow shipped on pages read dac-reference.readthedocs.io read 2026-11-03
  • CLI: documented CLI, documented. detection_rules CLI: validate-rule, validate-all, kibana import-rules, export-rules raw.githubusercontent.com read 2026-11-03
  • Rule API: documented Rule API, documented. DaC reference: export with the Detection Engine API; kibana import-rules loads rules into Kibana dac-reference.readthedocs.io read 2026-11-03
  • CI examples: partial CI examples, partial. Repo runs its own 'Unit Tests' GitHub Actions workflow; DaC reference says CI/CD pipeline is optional and gives no customer workflow YAML on pages read raw.githubusercontent.com read 2026-11-03
  • Env promotion: partial Env promotion, partial. DaC reference lists 'Pre-Production Testing' and 'Managing multiple rule sets'; no dev/staging/prod promotion flow described dac-reference.readthedocs.io read 2026-11-03
Google Security Operations
  • Git sync: documented Git sync, documented. chronicle/detection-rules README: 'rule manager' tool for a Detection-as-Code pipeline via the REST API raw.githubusercontent.com read 2026-11-03
  • PR deploy: partial PR deploy, partial. README describes a DaC pipeline for rules; no pull request trigger described raw.githubusercontent.com read 2026-11-03
  • CLI: documented CLI, documented. README: tools/content_manager is a 'CLI tool used to manage rules and other content' via the REST API raw.githubusercontent.com read 2026-11-03
  • Rule API: documented Rule API, documented. 'Rules API' and Unified Rules API: search, list, batch modify live, alerting and archive states docs.cloud.google.com read 2026-11-03
Not documented: CI examples, Env promotion.
Splunk Enterprise Security (Cisco)
  • Git sync: documented Git sync, documented. contentctl keeps content as YAML in a repo (security_content layout) and packages it into an app raw.githubusercontent.com read 2026-11-03
  • PR deploy: partial PR deploy, partial. Sample workflows build and unit-test on pull_request; loading into a Splunk environment is a manual step raw.githubusercontent.com read 2026-11-03
  • CLI: documented CLI, documented. contentctl init, new, validate, build, test; ecosystem table: 'Generate, validate, build, test, and deploy' raw.githubusercontent.com read 2026-11-03
  • CI examples: documented CI examples, documented. 'Sample CICD Workflows': GitHub Actions build and unit-testing YAML; no GitLab example raw.githubusercontent.com read 2026-11-03
Not documented: Rule API, Env promotion.
Microsoft Sentinel
  • Git sync: documented Git sync, documented. 'Repositories': connect a workspace to GitHub or Azure DevOps; content deploys from the repo learn.microsoft.com read 2026-11-03
  • PR deploy: documented PR deploy, documented. Repository connection deploys updated analytics rules, hunting queries, parsers, playbooks automatically on repo change learn.microsoft.com read 2026-11-03
  • Rule API: documented Rule API, documented. Alert Rules REST API: Create Or Update, Delete, Get, List learn.microsoft.com read 2026-11-03
  • CI examples: documented CI examples, documented. Repository connection creates the GitHub workflow or Azure DevOps pipeline; docs set workflow permissions learn.microsoft.com read 2026-11-03
  • Env promotion: partial Env promotion, partial. Connections map repo content to workspaces and 'smart deployments' track changes; no staged dev to prod flow described learn.microsoft.com read 2026-11-03
Not documented: CLI.
Sigma and pySigma
  • CLI: partial CLI, partial. sigma-cli: convert, list, plugin install; pySigma 'Validating Sigma Rules'; no deploy step sigmahq-pysigma.readthedocs.io read 2026-11-03
  • CI examples: partial CI examples, partial. Sigma repo's own GitHub Actions 'Sigma Rule Tests' (yamllint, logsource tests); not a deploy pipeline raw.githubusercontent.com read 2026-11-03
Not documented: Git sync, PR deploy, Rule API, Env promotion.
Sekoia.io
  • Rule API: documented Rule API, documented. 'Create a SIGMA rule' tutorial: POST /v1/sic/conf/rules-catalog/rules; search rules tutorial docs.sekoia.com read 2026-11-03
Not documented: Git sync, PR deploy, CLI, CI examples, Env promotion.
Anvilogic
  • Env promotion: partial Env promotion, partial. 'Deploy everywhere from a single workflow across SIEMs and data platforms'; multi-platform deploy, not staged environments anvilogic.com read 2026-11-03
Not documented: Git sync, PR deploy, CLI, Rule API, CI examples.
HuntersNot documented: Git sync, PR deploy, CLI, Rule API, CI examples, Env promotion.
SOC Prime
  • Git sync: partial Git sync, partial. Threat Detection Marketplace: 'Source detection rules into SOC Prime repository or your existing ones' (product page) socprime.com read 2026-11-03
  • CI examples: partial CI examples, partial. Platform page lists 'adapt CI/CD workflows' as a benefit; no workflow shown socprime.com read 2026-11-03
Not documented: PR deploy, CLI, Rule API, Env promotion.
Detecteam
  • CI examples: partial CI examples, partial. 'GitHub Actions' listed among integrations and partners; no workflow shown detecteam.com read 2026-11-03
Not documented: Git sync, PR deploy, CLI, Rule API, Env promotion.
Mate SecurityNot documented: Git sync, PR deploy, CLI, Rule API, CI examples, Env promotion.
CardinalOps (Cribl)Not documented: Git sync, PR deploy, CLI, Rule API, CI examples, Env promotion.
SnapAttack (Cisco)Not documented: Git sync, PR deploy, CLI, Rule API, CI examples, Env promotion.

Other groups: Languages, Testing, Coverage analytics, Rule health, Library. Back to the full matrix.