Detection As Code

MatanoRust

An open source, serverless security data lake for AWS that normalizes logs, enables detection-as-code, and supports petabyte-scale threat hunting.

Splunk Security ContentPython

An open-source repository of security detections, analytic stories, and response playbooks mapped to MITRE ATT&CK for Splunk Enterprise Security.

Chronicle (GCP) Detection RulesPython

A collection of example YARA-L detection rules and dashboards for Google Security Operations (SecOps).

Panther Labs Detection RulesPython

A collection of built-in detection rules and policies for Panther, a modern SIEM, enabling security monitoring as code.

Sigma2KQLPython

Automatically converts Sigma detection rules to Kusto Query Language (KQL) for Microsoft Defender and Sentinel.

Sigma2SPLPython

Automatically converts Sigma detection rules into Splunk SPL queries for security monitoring and threat hunting.