Detection as Code

Testing: 5 capabilities

Testing is documented to 24 percent across the 14 platforms (documented counts 1, partial 0.5). The capabilities are Unit tests, Replay, Synthetic events, Backtest reports, Test coverage. Each row below gives the page that supports a documented or partial cell, with its read date.

Testing columns only.
PlatformTestingScore
Unit testsReplaySynthetic eventsBacktest reportsTest coverage
PantherPanther, Unit tests: documenteddocumentedPanther, Replay: documenteddocumentedPanther, Synthetic events: not documentednot documentedPanther, Backtest reports: partialpartialPanther, Test coverage: not documentednot documented2.5 / 5
Elastic SecurityElastic Security, Unit tests: documenteddocumentedElastic Security, Replay: documenteddocumentedElastic Security, Synthetic events: partialpartialElastic Security, Backtest reports: not documentednot documentedElastic Security, Test coverage: not documentednot documented2.5 / 5
Google Security OperationsGoogle Security Operations, Unit tests: not documentednot documentedGoogle Security Operations, Replay: documenteddocumentedGoogle Security Operations, Synthetic events: partialpartialGoogle Security Operations, Backtest reports: partialpartialGoogle Security Operations, Test coverage: not documentednot documented2.0 / 5
Splunk Enterprise Security (Cisco)Splunk Enterprise Security (Cisco), Unit tests: documenteddocumentedSplunk Enterprise Security (Cisco), Replay: partialpartialSplunk Enterprise Security (Cisco), Synthetic events: documenteddocumentedSplunk Enterprise Security (Cisco), Backtest reports: partialpartialSplunk Enterprise Security (Cisco), Test coverage: not documentednot documented3.0 / 5
Microsoft SentinelMicrosoft Sentinel, Unit tests: not documentednot documentedMicrosoft Sentinel, Replay: documenteddocumentedMicrosoft Sentinel, Synthetic events: not documentednot documentedMicrosoft Sentinel, Backtest reports: not documentednot documentedMicrosoft Sentinel, Test coverage: not documentednot documented1.0 / 5
Sigma and pySigmaSigma and pySigma, Unit tests: not documentednot documentedSigma and pySigma, Replay: not documentednot documentedSigma and pySigma, Synthetic events: not documentednot documentedSigma and pySigma, Backtest reports: not documentednot documentedSigma and pySigma, Test coverage: not documentednot documented0.0 / 5
Sekoia.ioSekoia.io, Unit tests: partialpartialSekoia.io, Replay: documenteddocumentedSekoia.io, Synthetic events: not documentednot documentedSekoia.io, Backtest reports: partialpartialSekoia.io, Test coverage: not documentednot documented2.0 / 5
AnvilogicAnvilogic, Unit tests: partialpartialAnvilogic, Replay: not documentednot documentedAnvilogic, Synthetic events: partialpartialAnvilogic, Backtest reports: not documentednot documentedAnvilogic, Test coverage: partialpartial1.5 / 5
HuntersHunters, Unit tests: not documentednot documentedHunters, Replay: documenteddocumentedHunters, Synthetic events: not documentednot documentedHunters, Backtest reports: not documentednot documentedHunters, Test coverage: not documentednot documented1.0 / 5
SOC PrimeSOC Prime, Unit tests: not documentednot documentedSOC Prime, Replay: not documentednot documentedSOC Prime, Synthetic events: not documentednot documentedSOC Prime, Backtest reports: not documentednot documentedSOC Prime, Test coverage: not documentednot documented0.0 / 5
DetecteamDetecteam, Unit tests: partialpartialDetecteam, Replay: not documentednot documentedDetecteam, Synthetic events: partialpartialDetecteam, Backtest reports: not documentednot documentedDetecteam, Test coverage: partialpartial1.5 / 5
Mate SecurityMate Security, Unit tests: not documentednot documentedMate Security, Replay: not documentednot documentedMate Security, Synthetic events: not documentednot documentedMate Security, Backtest reports: not documentednot documentedMate Security, Test coverage: not documentednot documented0.0 / 5
CardinalOps (Cribl)no longer ships under this nameCardinalOps (Cribl), Unit tests: not documentednot documentedCardinalOps (Cribl), Replay: not documentednot documentedCardinalOps (Cribl), Synthetic events: not documentednot documentedCardinalOps (Cribl), Backtest reports: not documentednot documentedCardinalOps (Cribl), Test coverage: not documentednot documented0.0 / 5
SnapAttack (Cisco)no longer ships under this nameSnapAttack (Cisco), Unit tests: not documentednot documentedSnapAttack (Cisco), Replay: not documentednot documentedSnapAttack (Cisco), Synthetic events: not documentednot documentedSnapAttack (Cisco), Backtest reports: not documentednot documentedSnapAttack (Cisco), Test coverage: not documentednot documented0.0 / 5

documenteddocumentedpartialpartialnot documentednot documented

What each platform documents

Documented and partial cells with their notes and sources. A cell that names no feature is listed as not documented, which says only that the public pages read do not name it.

PlatformCells
Panther
  • Unit tests: documented Unit tests, documented. 'Testing': unit tests with test events and expected alert outcome; Panther sets no minimum number of tests docs.panther.com read 2026-11-03
  • Replay: documented Replay, documented. 'Data Replay (Beta)': test rules against historical log data before enabling docs.panther.com read 2026-11-03
  • Backtest reports: partial Backtest reports, partial. Data Replay previews a rule's outcome on real data; saved report not described docs.panther.com read 2026-11-03
Not documented: Synthetic events, Test coverage.
Elastic Security
  • Unit tests: documented Unit tests, documented. 'Unit testing' sub-component: Python unit tests for rules in the detection-rules repo dac-reference.readthedocs.io read 2026-11-03
  • Replay: documented Replay, documented. 'Run rules manually' over a specified past time range, tracked in the Manual runs table elastic.co read 2026-11-03
  • Synthetic events: partial Synthetic events, partial. README lists an 'RTAs' (red team automation) section; generation of test events not described on pages read raw.githubusercontent.com read 2026-11-03
Not documented: Backtest reports, Test coverage.
Google Security Operations
  • Replay: documented Replay, documented. 'Test rule' over a time range and 'Retrohunt' on historical data docs.cloud.google.com read 2026-11-03
  • Synthetic events: partial Synthetic events, partial. 'Event simulation' delivers realistic threat sequences into ingestion; pre-GA feature docs.cloud.google.com read 2026-11-03
  • Backtest reports: partial Backtest reports, partial. 'Test rule results' window; results are not saved and are not shown in the Rules dashboard docs.cloud.google.com read 2026-11-03
Not documented: Unit tests, Test coverage.
Splunk Enterprise Security (Cisco)
  • Unit tests: documented Unit tests, documented. 'Content Testing Guide': contentctl test runs detections against attack_data in a real Splunk instance raw.githubusercontent.com read 2026-11-03
  • Replay: partial Replay, partial. contentctl test replays Splunk Attack Data datasets; replay of a customer's historical data not described raw.githubusercontent.com read 2026-11-03
  • Synthetic events: documented Synthetic events, documented. Splunk Attack Range and Attack Data, Atomic Red Team listed in the contentctl ecosystem table raw.githubusercontent.com read 2026-11-03
  • Backtest reports: partial Backtest reports, partial. Detection Studio product page says engineers 'test, deploy, and monitor'; no saved backtest report described splunk.com read 2026-11-03
Not documented: Test coverage.
Microsoft Sentinel
  • Replay: documented Replay, documented. 'Manual rerun' of analytics rules and 'Results simulation: Test with current data' learn.microsoft.com read 2026-11-03
Not documented: Unit tests, Synthetic events, Backtest reports, Test coverage.
Sigma and pySigmaNot documented: Unit tests, Replay, Synthetic events, Backtest reports, Test coverage.
Sekoia.io
  • Unit tests: partial Unit tests, partial. 'Rule testing' with 'Test pattern' on historical data; no sample-event test cases docs.sekoia.com read 2026-11-03
  • Replay: documented Replay, documented. 'Rule testing': evaluate a Sigma pattern against historical data docs.sekoia.com read 2026-11-03
  • Backtest reports: partial Backtest reports, partial. 'Test results visualization' shows detection frequency and event distribution; not saved as a report docs.sekoia.com read 2026-11-03
Not documented: Synthetic events, Test coverage.
Anvilogic
  • Unit tests: partial Unit tests, partial. Detection editor shows version with TEST and DEPLOY steps; 'validating logic' named; test cases not described anvilogic.com read 2026-11-03
  • Synthetic events: partial Synthetic events, partial. 'Attack Simulation' Blueprint pulls completed test results into a detection queue (product page) anvilogic.com read 2026-11-03
  • Test coverage: partial Test coverage, partial. ATT&CK technique coverage shows Validated, Deployed and Gap; 'Track detection validation efforts' anvilogic.com read 2026-11-03
Not documented: Replay, Backtest reports.
Hunters
  • Replay: documented Replay, documented. 'Test logic': choose a timeframe and view samples of events that would generate leads docs.hunters.ai read 2026-11-03
Not documented: Unit tests, Synthetic events, Backtest reports, Test coverage.
SOC PrimeNot documented: Unit tests, Replay, Synthetic events, Backtest reports, Test coverage.
Detecteam
  • Unit tests: partial Unit tests, partial. 'includes the required test to validate detection quality'; test format not described detecteam.com read 2026-11-03
  • Synthetic events: partial Synthetic events, partial. 'Generate attack behavior data natively like your SIEM/XDR/Data Lake sees them' (scenario library) detecteam.com read 2026-11-03
  • Test coverage: partial Test coverage, partial. 'Measure Detection Performance': metrics and evidence on what detections see and miss detecteam.com read 2026-11-03
Not documented: Replay, Backtest reports.
Mate SecurityNot documented: Unit tests, Replay, Synthetic events, Backtest reports, Test coverage.
CardinalOps (Cribl)Not documented: Unit tests, Replay, Synthetic events, Backtest reports, Test coverage.
SnapAttack (Cisco)Not documented: Unit tests, Replay, Synthetic events, Backtest reports, Test coverage.

Other groups: Languages, Source control and CI, Coverage analytics, Rule health, Library. Back to the full matrix.