A POC to implement Detection-as-Code with Terraform and Sumo Logic.
-
Updated
Jul 27, 2023 - Python
#
detection-as-code
Here are 62 public repositories matching this topic...
ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.
-
Updated
Jun 28, 2026 - Python
Official, curated detection content (Sigma, YARA, IOC packs) for the Rustinel endpoint detection engine.
security ioc incident-response sigma yara blue-team edr mitre-attack threat-detection detection-engineering detection-as-code rustinel
-
Updated
Jul 14, 2026 - Python
Infrastructure as code for CrowdStrike — manage detections, saved searches, lookup files, and more with a Terraform-like lifecycle.
-
Updated
Jun 29, 2026 - Python
A Python-native Detection as Code Framework
-
Updated
Jan 23, 2026 - Python
A Pythonic Detection Rules Framework
-
Updated
May 19, 2026 - Python
Automated Detection-as-Code (DaC) CI/CD pipeline for validating and programmatically deploying SIEM detection rules via GitHub Actions and the Wazuh API
-
Updated
Jul 13, 2026 - Python
A curated reference of threat detection engineering & incident response frameworks, tools, and detection rule sources.
security reference detection incident-response threat-modeling threat-intelligence mitre-attack threat-detection incident-response-tooling detection-engineering risk-based detection-as-code risk-based-alerting distributed-alerting detections-as-code
-
Updated
Jun 30, 2026
9 MITRE ATT&CK-mapped KQL detections on a live Microsoft Sentinel + Defender XDR environment (control-plane, endpoint, identity), with a PR-gated Detection-as-Code pipeline (GitHub Actions, OIDC), SOAR playbooks, and a SOC 2 control mapping.
incident-response siem sigma soc soar blue-team azure-security mitre-attack threat-detection kql azure-sentinel detection-engineering microsoft-sentinel detection-as-code security-detection
-
Updated
Jul 6, 2026 - Kusto
Rust stream processing engine for real-time detection. Open-source Apache Flink alternative built for detection engineering, fraud prevention, and MITRE ATT&CK coverage. 1.5M events/sec, single 15MB binary, no JVM.
rust cep pattern-matching stream-processing complex-event-processing observability event-processing streaming-engine fraud-detection streaming-analytics mitre-attack threat-detection real-time-detection detection-engineering sigma-rules detection-as-code soc-automation flink-alternative ai-soc siem-alternative
-
Updated
Jul 17, 2026 - Rust
A threat hunter that lives in your terminal with memories in Notion.
golang security incident-response siem sigma claude detection-engineering anthropic llm-agent detection-as-code
-
Updated
Jul 3, 2026 - Go
42-project AWS SOC/SOAR portfolio with Wazuh, TheHive, Cortex, MISP, n8n, AWS security, Terraform, detection engineering, IR, dashboards, and GenAI/MCP/RAG/agentic AI security automation.
incident-response siem misp cortex modsecurity soc cloudtrail aws-security security-automation threat-intelligence wazuh soar blue-team ai-security thehive-project detection-engineering suricate soc-analyst detection-as-code genai-security
-
Updated
Jun 13, 2026 - Python
GitHub Action for Detection-as-Code (DaC) powered by RSigma: lint, validate, backtest, and ATT&CK coverage
-
Updated
Jun 26, 2026 - Shell
Parallax — a self-hosted toolkit for SentinelOne AI-SIEM engineers: map parser & detection-library coverage, visualize MITRE ATT&CK gaps, and validate that detection rules actually fire by generating synthetic test logs from each rule's own logic and verifying the resulting alerts.
docker xdr siem mitre-attack threat-detection security-operations fastapi detection-engineering sentinelone detection-as-code
-
Updated
Jul 17, 2026 - Python
Detection as Code portfolio. Validated Python pipeline, Atomic Red Team telemetry, KQL, Sigma, and Sentinel-aligned detections.
python threat-hunting siem sigma mitre-attack kql detection-engineering atomic-red-team microsoft-sentinel detection-as-code
-
Updated
Jun 5, 2026 - Python
Security infrastructure · Detection as code · Multi-cloud
-
Updated
Mar 14, 2026 - CSS
Detection as Code pipeline for Splunk detections with YAML rules, schema and SPL validation, PR governance, self-hosted GitHub Actions, and automated Splunk REST deployment.
yaml splunk siem spl soc security-automation devsecops mitre-attack github-actions detection-as-code
-
Updated
May 11, 2026 - Python
Detection-as-code and SOAR automation reference: platform-agnostic Sigma detection rules and response playbooks for enterprise security operations
splunk incident-response cybersecurity infosec siem security-automation soar qradar security-operations detection-engineering sigma-rules microsoft-sentinel detection-as-code
-
Updated
Jul 10, 2026
Detection-as-code for Microsoft Sentinel and Defender XDR. 12 analytic rules, 10 hunting queries, 4 SOAR playbooks, ATT&CK Navigator coverage, CI validation, and full L3 SOC workflow documentation.
incident-response cybersecurity threat-hunting soc security-automation logic-apps soar blue-team mitre-attack security-operations kql azure-sentinel detection-engineering sigma-rules defender-for-endpoint atomic-red-team microsoft-sentinel detection-as-code entra-id defender-xdr
-
Updated
May 14, 2026 - Python
Improve this page
Add a description, image, and links to the detection-as-code topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the detection-as-code topic, visit your repo's landing page and select "manage topics."