Rules in Git. Tested in CI. Deployed by pipeline. Validated against real adversary behaviour - and monitored for the day they quietly stop working.
Three ways in
The same discipline at three levels of commitment. Most people start at the top and work down.
Open library
Sigma, KQL, SPL and EQL detections with their false positives, log-source requirements and validation steps documented. Free, permissively licensed, copy-paste ready.
Browse the libraryProduct
DetectionOps Pipeline lints, tests and deploys your rules to Splunk, Sentinel, Elastic and Chronicle - then tells you when a deployed detection goes quiet.
See the platformConsulting
Detection programme builds, purple-team validation and SIEM migrations. We work alongside your engineers and leave the capability behind, not a dependency.
How we workField notes
Long-form walkthroughs of real detections - including the versions that did not work and why.
Most detection-as-code talks stop at 'put your rules in Git'. Here is the rest of it - the lint stage, the unit tests, the deploy gate, and the part nobody mentions: what happens when a rule starts failing in production.
A green heat map with 78% coverage is the most comfortable lie in security. Here is why technique counting breaks down, and what to measure instead.
A full walkthrough - the protocol behaviour, the naive rule everyone writes first, why it drowns you, and the tuned version with its test cases.
Open rule library
A detection without documented false positives is a draft. Each rule here carries its log-source requirements, its tuning caveats and the atomic test that proves it fires.
A non-allowlisted process opening LSASS with memory-read rights - the core primitive behind Mimikatz, comsvcs.dll dumping and most credential theft tooling.
Directory replication rights exercised by a principal that is not a domain controller. If this fires for real, the domain is gone.
Someone blinding the audit trail. One of the highest-signal cloud detections you can deploy - near-zero noise outside planned change windows.
Coverage
Coverage counted by rules that exist is a comfortable lie. We colour ours by when a detonation last proved the rule fires - cells go pale as their evidence ages.
Initial Access
2/4
Execution
3/4
Persistence
4/4
Privilege Escalation
1/3
Defense Evasion
3/4
Credential Access
4/4
Discovery
0/3
Lateral Movement
3/3
validated | stale | gap
No news roundups, no vendor threat reports. One technique, the rule, the tuning, the tests and the parts that did not work. Unsubscribe in one click.
Not wired to a provider yet - connect Buttondown, Ghost or ConvertKit in
src/pages/index.astro.