Detection as Code

Platforms

12 platforms are profiled and 2 more are scored with a short note. The list is in rubric order. Totals within 0.25 form a band, so neighbours in this list are not always separable. Application security scanning and infrastructure-as-code tools are out of scope.

  1. Microsoft Sentinel 7.81
  2. Elastic Security 7.60
  3. Google Security Operations 6.83
  4. Panther 6.31
  5. Splunk Enterprise Security (Cisco) 6.21
  6. Sigma and pySigma 5.50
  7. Anvilogic 5.48
  8. Detecteam 5.26
  9. SOC Prime 5.11
  10. SnapAttack (Cisco) 4.61 scored, not profiled
  11. Mate Security 3.98
  12. CardinalOps (Cribl) 3.96 scored, not profiled
  13. Sekoia.io 3.46
  14. Hunters 3.44

The grid for all 14 is on the home page, and the scoring is on the rubric page.

How a profile is built

Each profile gives a short summary, the eight rubric scores with the reason and source for each, the 33 capabilities as a strip of squares with a text count, where the platform is strong and where it is behind, the prices as published, the customers it names, its recent releases, the claims it makes with their audit grade, and who should shortlist it. Vendor statements are labelled vendor claim and every fact carries the page it came from and the date it was read.