Detection as Code

Hunters

Hunters scores 3.44 of 10, twelfth of the 12 profiled, in band E with Sekoia.io. It sells vendor-maintained detections for small teams, so it is kept to show buying content next to writing it. Its docs add a custom detector with a Test logic step and an ATT&CK Threat Coverage map.

Rubric total
3.44 of 10, fourteenth of 14 scored, twelfth of 12 profiled
Matrix score
6.5 of 33 (3 documented, 7 partial, 23 not documented)
Rule health
0 documented, 2 partial of 5 matrix rule-health columns
Ownership
Independent company. No acquisition, merger or rebrand found on the vendor's site or in one 2026 news search. The read was of the homepage, platform, blog and news pages. Aggregators list the company as independent with its last large round in 2022. hunters.security read 2026-11-03
Website
hunters.security

What Hunters is

Hunters sells the Hunters SOC Platform, a SIEM aimed at small security teams. Data is standardised to OCSF in a security data lake that the customer owns or Hunters manages, and detections are built in and maintained by Hunters' Team Axon service group (vendor claims, hunters.security, read 2026-11-03). The model is buy the content, not write it.

The docs add a guided custom detector with Filter and Group By modes and a Test logic step, and a detectors page listing leads, alerts and clusters per detector. The platform page names no rule language and describes no repo sync or CI. The matrix keeps Hunters so a reader can see the buy-the-content model next to the write-it model.

Vendor description: Hunters sells the Hunters SOC Platform, a SIEM built for small security teams. It ingests data into a security data lake that the customer owns or Hunters manages, standardises it to OCSF, and runs vendor-maintained detections from its Team Axon service group. The platform adds AI triage, investigation and response. hunters.security read 2026-11-03 vendor claim

How Hunters scores on the rubric

3.44 of 10 across eight weighted criteria. It sits in band E with Sekoia.io: totals within 0.25 are a band, not a ladder. Each score has its reason and the page it was read from. The rubric explains the bands.

Rule languages and convers..3.0Git-native workflow and CI..3.0Testing4.0Coverage analytics4.0Rule health3.5Versioning and rollback3.0Content library size and f..4.0Pricing transparency3.0

Hunters on the eight rubric criteria. Part = weight times score over 100; the parts sum to the total.

CriterionWeightScoreStatusReason and source
Rule languages and conversion paths153.0not documentedData is normalised to OCSF; the platform page names no rule language. hunters.security read 2026-11-04
Git-native workflow and CI/CD183.0not documentedPage says customers are not required to build detections themselves; no repo sync or CI. vendor claim hunters.security read 2026-11-04
Testing154.0not documentedDetections are 'continuously tested and refined by Team Axon' (vendor claim); customers get no documented test tooling. vendor claim hunters.security read 2026-11-04
Coverage analytics124.0not documentedNo ATT&CK coverage view on the page read. hunters.security read 2026-11-04
Rule health183.5not documentedClaims a 90 percent cut in excessive alerting (vendor claim, no method); no rule-level health view. vendor claim hunters.security read 2026-11-04
Versioning and rollback83.0not documentedNot documented. hunters.security read 2026-11-04
Content library size and freshness84.0not documentedBuilt-in detections maintained by Team Axon; no count. vendor claim hunters.security read 2026-11-04
Pricing transparency63.0not documentedhunters.security/pricing returned 404. hunters.security read 2026-11-04
Total, of 101003.44Sum of the eight parts: 0.45 + 0.54 + 0.60 + 0.48 + 0.63 + 0.24 + 0.32 + 0.18

The 33 capabilities for Hunters

Languages: 0 documented, 1 partial of 10
Hunters, Sigma native: not documentedHunters, Sigma conversion: not documentedHunters, YARA-L: not documentedHunters, SPL: not documentedHunters, KQL: not documentedHunters, EQL or ES|QL: not documentedHunters, Python: not documentedHunters, Visual builder: partialHunters, YARA: not documentedHunters, Lucene or KQL-like: not documented
Source control and CI: 0 documented, 0 partial of 6
Hunters, Git sync: not documentedHunters, PR deploy: not documentedHunters, CLI: not documentedHunters, Rule API: not documentedHunters, CI examples: not documentedHunters, Env promotion: not documented
Testing: 1 documented, 0 partial of 5
Hunters, Unit tests: not documentedHunters, Replay: documentedHunters, Synthetic events: not documentedHunters, Backtest reports: not documentedHunters, Test coverage: not documented
Coverage analytics: 2 documented, 2 partial of 4
Hunters, ATT&CK map: documentedHunters, Gap view: documentedHunters, Data sources: partialHunters, Log source health: partial
Rule health: 0 documented, 2 partial of 5
Hunters, Noisy rules: partialHunters, Broken rules: not documentedHunters, Field drift: not documentedHunters, Rule cost: not documentedHunters, Lifecycle: partial
Library: 0 documented, 2 partial of 3
Hunters, Library count: partialHunters, Community: not documentedHunters, Cadence: partial

documenteddocumentedpartialpartialnot documentednot documented

Notes and sources for each cell are on the group pages: Languages, Source control and CI, Testing, Coverage analytics, Rule health, Library.

Where Hunters is strong

Where Hunters is behind

What only Hunters publishes

Hunters standardises security data to OCSF and lets a customer bring its own data lake or have Hunters manage one (vendor claim). hunters.security read 2026-11-03

Pricing as published for Hunters

No public pricing. No pricing page was found on hunters.security on 2026-11-03, so the price model is not published. hunters.security read 2026-11-03

Named customers of Hunters

Names below are as the source page lists them.

Customers named on public pages. Every name is a vendor claim from the page cited in its row.

CustomerSource
TheRealRealhunters.security read 2026-11-03
ChargePointhunters.security read 2026-11-03
Skyscannerhunters.security read 2026-11-03
Booking (from logo alt text)hunters.security read 2026-11-03
Cimpress (named by a quoted reviewer)hunters.security read 2026-11-03
Unzer (named by a quoted reviewer)hunters.security read 2026-11-03
Pennymac (named by a quoted reviewer)hunters.security read 2026-11-03

Recent releases and news for Hunters

No dated releases were recorded for Hunters in the read.

Claims Hunters makes about itself

Each figure is the vendor's. The evidence grade is defined on the rubric page: A measured by a third party with the method published, B vendor-measured with sample and method, C vendor figure with no method, D figure with no source.

Vendor claims with the evidence grade and who measured.

ClaimGradeMeasured bySource
Reduces alert triage by 80 percent vendor claimCvendorhunters.security read 2026-11-03
Reduces excessive alerting by 90 percent vendor claimCvendorhunters.security read 2026-11-03
Gartner Peer Insights overall rating of 4.8 out of 5.0 vendor claimBthird_partyhunters.security read 2026-11-03

Shortlist Hunters when

Verdict on Hunters

Twelfth of 12 at 3.44, in band E with Sekoia.io (3.46); the buy-the-content model scores low on a rubric built for teams that write rules.

Compare Hunters

Alternatives to Hunters. Head-to-head diffs: SOC Prime, Anvilogic, Panther, Sigma and pySigma, Detecteam, Elastic Security, Splunk Enterprise Security (Cisco), Sekoia.io, Google Security Operations, Microsoft Sentinel, Mate Security.