Detecteam
Detecteam scores 5.26 of 10, eighth of the 12 profiled, in band C with Sigma and pySigma and Anvilogic. Its REFLEX platform generates attack behaviour data from an ATT&CK-based scenario library to test detections. Only the home and solutions pages carried body text, so every cell rests on vendor claims.
- Rubric total
- 5.26 of 10, eighth of 14 scored, eighth of 12 profiled
- Matrix score
- 3.5 of 33 (0 documented, 7 partial, 26 not documented)
- Rule health
- 0 documented, 0 partial of 5 matrix rule-health columns
- Ownership
- Independent company
- Website
- detecteam.com
What Detecteam is
Detecteam sells REFLEX, a platform that turns adversary behaviours and attack trees into generated test data and deployed detections, then measures detection performance (vendor claim, detecteam.com, read 2026-11-03). It is built on ATT&CK, STIX and TAXII and includes an AI-powered Adversary Behavior Builder.
The home page names no rule language. It lists Splunk, Microsoft Sentinel, Google SecOps, Elastic Security, AWS Security, Databricks and Cribl Stream as targets, and GitHub Actions among its integrations. Only the home page and solutions page carried body text in the scoring pass, so the testing and coverage scores are vendor claims, not documented behaviour.
Vendor description: Platform (REFLEX) that turns adversary behaviours and attack trees into generated test data and deployed detections, measures detection performance, and automates the detection lifecycle. detecteam.com read 2026-11-03 vendor claim
How Detecteam scores on the rubric
5.26 of 10 across eight weighted criteria. It sits in band C with Sigma and pySigma and Anvilogic: totals within 0.25 are a band, not a ladder. Each score has its reason and the page it was read from. The rubric explains the bands.
Detecteam on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.
| Criterion | Weight | Score | Status | Reason and source |
|---|---|---|---|---|
| Rule languages and conversion paths | 15 | 5.0 | partial | Lists Splunk, Microsoft Sentinel, Google SecOps, Elastic Security, AWS Security, Databricks and Cribl Stream as targets; rule languages are not named. vendor claim detecteam.com read 2026-11-04 |
| Git-native workflow and CI/CD | 18 | 5.0 | partial | Home page lists a GitHub Actions integration and detection-as-code workflows with no repo sync, CLI or API detail. vendor claim detecteam.com read 2026-11-04 |
| Testing | 15 | 7.0 | partial | Generates attack behaviour data as the SIEM or data lake would see it, from an ATT&CK-based scenario library; method detail and replay mechanics are not published. vendor claim detecteam.com read 2026-11-04 |
| Coverage analytics | 12 | 7.0 | partial | Built on ATT&CK, STIX and TAXII, with coverage, quality and accuracy metrics; no sample view is published. vendor claim detecteam.com read 2026-11-04 |
| Rule health | 18 | 5.0 | partial | Claims metrics on detection quality and accuracy; no noisy-rule, broken-rule or drift detail. vendor claim detecteam.com read 2026-11-04 |
| Versioning and rollback | 8 | 4.0 | not documented | Versioning is not stated on the home page. detecteam.com read 2026-11-04 |
| Content library size and freshness | 8 | 4.0 | not documented | Refers to a 'Massive Attack & Detection Library' with no count. vendor claim detecteam.com read 2026-11-04 |
| Pricing transparency | 6 | 3.0 | not documented | Contact Us only; no pricing page found. detecteam.com read 2026-11-04 |
| Total, of 10 | 100 | 5.26 | Sum of the eight parts: 0.75 + 0.90 + 1.05 + 0.84 + 0.90 + 0.32 + 0.32 + 0.18 | |
The 33 capabilities for Detecteam
documentedpartialnot documented
Where Detecteam is strong
- It generates attack behaviour data as a SIEM or data lake would see it, from an ATT&CK-based scenario library (vendor claim). detecteam.com read 2026-11-04
- It is built on ATT&CK, STIX and TAXII and claims coverage, quality and accuracy metrics for detections. No sample view is published. detecteam.com read 2026-11-04
- It lists seven deployment targets: Splunk, Microsoft Sentinel, Google SecOps, Elastic Security, AWS Security, Databricks and Cribl Stream (vendor claim). detecteam.com read 2026-11-04
Where Detecteam is behind
- No rule language, Sigma support or conversion path is named on the home page, so languages score partial on targets alone. detecteam.com read 2026-11-04
- A GitHub Actions integration is listed, with no repo sync, CLI or API detail and no workflow shown. detecteam.com read 2026-11-04
- There is no pricing page, only a Contact Us route, and no named customers, detection count or versioning statement. detecteam.com read 2026-11-04
What only Detecteam publishes
Devo announced a partnership with Detecteam on 2025-04-23 to combine the Devo platform with REFLEX for detection development. globenewswire.com read 2026-11-03
Pricing as published for Detecteam
No pricing on the home page or in any page found. The home page offers 'Start Free Trial' and 'Schedule Demo'. There is no pricing or docs link in the navigation. detecteam.com read 2026-11-04
Named customers of Detecteam
No customers are named on the public pages read for Detecteam.
Recent releases and news for Detecteam
- 2025-04-23 Devo announces partnership with Detecteam to automate detection engineering. Strategic technical partnership that combines the Devo platform with Detecteam's REFLEX platform for detection development. globenewswire.com read 2026-11-03 vendor claim
Claims Detecteam makes about itself
Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.
Vendor claims with the evidence grade and who measured.
| Claim | Grade | Measured by | Source |
|---|---|---|---|
| Accelerates detection development and deployment by 95 percent, reducing the need for scarce and costly expertise (stated in a Devo partnership release) vendor claim | C | vendor | globenewswire.com read 2026-11-03 |
Shortlist Detecteam when
- Your open question is whether detections fire on the behaviour they claim to cover, not how they are stored.
- You run one of the seven listed targets and can test through a proof of concept.
- You are ready to ask for test method, replay mechanics and versioning in writing.
Verdict on Detecteam
Eighth of 12 at 5.26, in band C with Sigma and pySigma (5.50) and Anvilogic (5.48), and 0.15 above SOC Prime, on vendor claims alone.
Compare Detecteam
Alternatives to Detecteam. Head-to-head diffs: SOC Prime, Anvilogic, Panther, Sigma and pySigma, Elastic Security, Splunk Enterprise Security (Cisco), Sekoia.io, Hunters, Google Security Operations, Microsoft Sentinel, Mate Security.