A POC to implement Detection-as-Code with Terraform and Sumo Logic.
-
Updated
Jul 27, 2023 - Python
#
detection-as-code
Here are 68 public repositories matching this topic...
ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.
-
Updated
Jul 26, 2026 - Python
Official, curated detection content (Sigma, YARA, IOC packs) for the Rustinel endpoint detection engine.
security ioc incident-response sigma yara blue-team edr mitre-attack threat-detection detection-engineering detection-as-code rustinel
-
Updated
Jul 21, 2026 - Python
Infrastructure as code for CrowdStrike — manage detections, saved searches, lookup files, and more with a Terraform-like lifecycle.
-
Updated
Jun 29, 2026 - Python
A Python-native Detection as Code Framework
-
Updated
Jan 23, 2026 - Python
A Pythonic Detection Rules Framework
-
Updated
May 19, 2026 - Python
Automated Detection-as-Code (DaC) CI/CD pipeline for validating and programmatically deploying SIEM detection rules via GitHub Actions and the Wazuh API
-
Updated
Jul 20, 2026 - Python
A curated reference of threat detection engineering & incident response frameworks, tools, and detection rule sources.
security reference detection incident-response threat-modeling threat-intelligence mitre-attack threat-detection incident-response-tooling detection-engineering risk-based detection-as-code risk-based-alerting distributed-alerting detections-as-code
-
Updated
Jun 30, 2026
9 MITRE ATT&CK-mapped KQL detections on a live Microsoft Sentinel + Defender XDR environment (control-plane, endpoint, identity), with a PR-gated Detection-as-Code pipeline (GitHub Actions, OIDC), SOAR playbooks, and a SOC 2 control mapping.
incident-response siem sigma soc soar blue-team azure-security mitre-attack threat-detection kql azure-sentinel detection-engineering microsoft-sentinel detection-as-code security-detection
-
Updated
Jul 6, 2026 - Kusto
Autonomous cybersecurity agent for SMBs — self-hosted, AI-powered, WASM-sandboxed skills
-
Updated
Jul 17, 2026 - Rust
Rust stream processing engine for real-time detection. Open-source Apache Flink alternative built for detection engineering, fraud prevention, and MITRE ATT&CK coverage. 1.5M events/sec, single 15MB binary, no JVM.
rust cep pattern-matching stream-processing complex-event-processing observability event-processing streaming-engine fraud-detection streaming-analytics mitre-attack threat-detection real-time-detection detection-engineering sigma-rules detection-as-code soc-automation flink-alternative ai-soc siem-alternative
-
Updated
Jul 20, 2026 - Rust
A threat hunter that lives in your terminal with memories in Notion.
golang security incident-response siem sigma claude detection-engineering anthropic llm-agent detection-as-code
-
Updated
Jul 3, 2026 - Go
GitHub Action for Detection-as-Code (DaC) powered by RSigma: lint, validate, backtest, and ATT&CK coverage
-
Updated
Jun 26, 2026 - Shell
30 + project AWS SOC/SOAR Ecosystem portfolio with Wazuh, TheHive, Cortex, MISP, n8n, network security monitoring, Threat Detection & Hunting, Alert triage, Log Analysis, Detection engineering, Incident Response, dashboards, and AI security automation.
incident-response network-monitoring siem misp cortex modsecurity soc cloudtrail security-automation threat-intelligence wazuh soar blue-team threat-detection thehive-project loganalysis detection-engineering alert-triage soc-analyst detection-as-code
-
Updated
Jul 26, 2026 - Python
A practical Detection-as-Code platform that brings software engineering principles to threat detection, validation, and security operations.
-
Updated
Jul 15, 2026 - Python
Sigma detection rule writing, validation & conversion for Claude Code -- LLM-assisted + pySigma + multi-backend (Splunk, Elastic, Kibana, Wazuh). 70+ production rules + 3 MCP tools + 3 skills.
elasticsearch kibana splunk threat-hunting siem sigma wazuh blue-team mitre-attack threat-detection detection-engineering sigma-rules detection-as-code mcp-server claude-code claude-code-plugin
-
Updated
Jul 24, 2026 - Python
Parallax — a self-hosted toolkit for SentinelOne AI-SIEM engineers: map parser & detection-library coverage, visualize MITRE ATT&CK gaps, and validate that detection rules actually fire by generating synthetic test logs from each rule's own logic and verifying the resulting alerts.
docker xdr siem mitre-attack threat-detection security-operations fastapi detection-engineering sentinelone detection-as-code
-
Updated
Jul 17, 2026 - Python
Detection as Code portfolio. Validated Python pipeline, Atomic Red Team telemetry, KQL, Sigma, and Sentinel-aligned detections.
python threat-hunting siem sigma mitre-attack kql detection-engineering atomic-red-team microsoft-sentinel detection-as-code
-
Updated
Jun 5, 2026 - Python
Detection as Code pipeline for Splunk detections with YAML rules, schema and SPL validation, PR governance, self-hosted GitHub Actions, and automated Splunk REST deployment.
yaml splunk siem spl soc security-automation devsecops mitre-attack github-actions detection-as-code
-
Updated
May 11, 2026 - Python
Improve this page
Add a description, image, and links to the detection-as-code topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the detection-as-code topic, visit your repo's landing page and select "manage topics."