detection-as-code

A POC to implement Detection-as-Code with Terraform and Sumo Logic.

Microsoft Sentinel SIEM Log Source Analyzer

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.

Official, curated detection content (Sigma, YARA, IOC packs) for the Rustinel endpoint detection engine.

Infrastructure as code for CrowdStrike — manage detections, saved searches, lookup files, and more with a Terraform-like lifecycle.

A Python-native Detection as Code Framework

A Pythonic Detection Rules Framework

Automated Detection-as-Code (DaC) CI/CD pipeline for validating and programmatically deploying SIEM detection rules via GitHub Actions and the Wazuh API

Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.

A curated reference of threat detection engineering & incident response frameworks, tools, and detection rule sources.

Data Loss Prevention as Code: author Microsoft Purview DLP policies in a YAML DSL, compile and validate them offline, deploy through a reviewable simulation-first pipeline.

Rust stream processing engine for real-time detection. Open-source Apache Flink alternative built for detection engineering, fraud prevention, and MITRE ATT&CK coverage. 1.5M events/sec, single 15MB binary, no JVM.

9 MITRE ATT&CK-mapped KQL detections on a live Microsoft Sentinel + Defender XDR environment (control-plane, endpoint, identity), with a PR-gated Detection-as-Code pipeline (GitHub Actions, OIDC), SOAR playbooks, and a SOC 2 control mapping.

A Panther Global Helper for enriching alerts using the Axonius CAASM platform

Parallax — a self-hosted toolkit for SentinelOne AI-SIEM engineers: map parser & detection-library coverage, visualize MITRE ATT&CK gaps, and validate that detection rules actually fire by generating synthetic test logs from each rule's own logic and verifying the resulting alerts.

Autonomous cybersecurity agent for SMBs — self-hosted, AI-powered, WASM-sandboxed skills

A practical Detection-as-Code platform that brings software engineering principles to threat detection, validation, and security operations.

Purple-team detection-engineering lab with ML-assisted Sigma/YARA rule generation, and coverage/FP/evasion scoring.

A threat hunter that lives in your terminal with memories in Notion.