The CI/CD your detections never got
Lint, test, deploy and monitor - the four stages that turn a rules repository into an operational system. Bring your own Git host and SIEM.
Pre-launch - pricing and capabilities below are the planned shape, not a shipped product.
# .detectionops.yml
version: 1
sources:
- path: detections/**/*.yml
format: sigma
checks:
- schema # valid Sigma, unique stable ids
- house-rules # falsepositives block required, attack tag required
- backends # every target backend can compile the rule
- tests # true/false positive cases must pass
targets:
- name: splunk-prod
backend: splunk
pipeline: splunk_windows
index: wineventlog
shadow_days: 7 # log matches, raise no tickets, for one week
- name: sentinel-prod
backend: kusto
pipeline: microsoft_xdr
workspace: soc-primary
health:
quiet_rule_alert: 14d # fired for 8 weeks, then stopped
precision_floor: 0.05 # below 5% for 4 weeks -> flag for review
source_watch: true # alert when a log source stops arrivingWhat it does
Four stages, one config file
Stages one and three are table stakes. Stage two is where the credibility comes from, and stage four is what nobody else builds.
Compile once, deploy everywhere
Write Sigma, ship SPL, KQL, EQL and Chronicle YARA-L. Backend-specific escape hatches for the ten percent that Sigma cannot express, tracked separately so you can see the drift.
Tests that run without a SIEM
True-positive and false-positive event fixtures evaluated against the rule AST locally. A tuning exclusion cannot merge without a test proving what it excludes.
Shadow deploys
New rules land enabled but silent. Seven days of real volume before anything reaches a queue, so the rule that would have fired 4,000 times never gets the chance.
Rule health monitoring
Weekly fire counts, precision, time-to-triage and log-source liveness per rule. Alerts on the change, not the number - a rule going quiet is the signal.
Coverage that expires
ATT&CK reporting driven by detonation results, not rule existence. Validation ages out at 90 days and the board fades accordingly.
Safe deletes
Rules removed from the repo are disabled, never deleted, and a run that would disable more than three at once stops and asks. Bad rebases happen.
Detonation-linked validation
Hook your atomic testing into the pipeline. A passing detonation stamps the rule with a date, and that date is what the coverage board reads. Nothing marks itself validated.
Tuning with a paper trail
Every exclusion carries an author, a reason and an expiry. Exclusions that nobody renews come back for review instead of quietly becoming permanent blind spots.
Log-source contracts
Declare the fields a rule depends on. When a source stops delivering one, the rules that need it are flagged as degraded rather than silently matching nothing.
Rule provenance
Every deployed detection links back to the commit, the reviewer and the detonation that promoted it. When an alert is questioned at 3am, that history is one click away.
Backends
Pricing
Priced per engineer, not per gigabyte
Your SIEM already charges by volume. Charging you again for the same data would be a strange way to run a business.
Open
Free Self-hosted CLI
Individual engineers and small teams
- Lint, convert and test locally
- All Sigma backends
- GitHub Actions workflow templates
- Community support
Team
$1,400 per month, up to 25 engineers
A detection function with a SIEM to feed
- Everything in Open
- Hosted pipeline and deploy runners
- Shadow deploys and safe deletes
- Rule health and decay alerting
- Validated coverage reporting
- Slack and Teams notifications
Enterprise
Talk to us Annual, volume-based
Multiple SIEMs, multiple business units
- Everything in Team
- Self-hosted runners in your VPC
- SSO, SCIM and audit export
- Multi-tenant rule governance
- Onboarding with our engineers
Not ready for a platform?
Most teams should build the first version themselves - it is two weeks of work and you learn what you actually need. The write-up is free and deliberately complete enough to follow without buying anything.
Read the build guide