Detection As Code

MatanoRust

An open source, serverless security data lake for AWS that normalizes logs, enables detection-as-code, and supports petabyte-scale threat hunting.

Splunk Security ContentPython

An open-source repository of security detections, analytic stories, and response playbooks mapped to MITRE ATT&CK for Splunk Enterprise Security.

Chronicle (GCP) Detection RulesPython

A collection of example YARA-L detection rules and dashboards for Google Security Operations (SecOps).

Panther Labs Detection RulesPython

A collection of built-in detection rules and policies for Panther, a modern SIEM, enabling security monitoring as code.