detection-as-code

A complete Sigma detection engineering toolkit: parser, linter, formatter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers 🦀

A POC to implement Detection-as-Code with Terraform and Sumo Logic.

Microsoft Sentinel SIEM Log Source Analyzer

Official, curated detection content (Sigma, YARA, IOC packs) for the Rustinel endpoint detection engine.

RuleVis is a powerful analysis tool that transforms your Wazuh ruleset into a dynamic, interactive force-directed graph. It helps you visualize the complex relationships between rules, identify critical dependencies, discover structural issues, and analyze the distribution of your rule IDs.

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.

Open, practitioner-maintained Detection Engineering curriculum.

A Python-native Detection as Code Framework

Sigma to Wazuh, Splunk and Sentinel from one source. Compiles 96% of SigmaHQ to Wazuh, refuses what it cannot translate faithfully, and ships 67 range-tested ATT&CK rules to prove it. MIT.

A Pythonic Detection Rules Framework

A curated reference of threat detection engineering & incident response frameworks, tools, and detection rule sources.

Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.

Automated Detection-as-Code (DaC) CI/CD pipeline for validating and programmatically deploying SIEM detection rules via GitHub Actions and the Wazuh API

A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.

Data Loss Prevention as Code: author Microsoft Purview DLP policies in a YAML DSL, compile and validate them offline, deploy through a reviewable simulation-first pipeline.

Unified Detection-as-Code engine for Google Security and beyond.

A helper for Wazuh Security Configuration Assessment (SCA) to create a custom SCA based on loosening.

The project utilizes of a wazuh-manager installed on WSL or a Linux machine, allowing testing custom rules locally before moving to production.

The detection engine: correlation rules on the event stream you already forward, outside the SIEM. Sequences across hosts in log time, state that survives a crash. Rust, no JVM, embeddable.