Detection Engineering & Detection-as-Code
Writes, tests, tunes and measures detection rules as code, against MITRE ATT&CK.
Overview
Detection engineering treats detection rules like software: written in a portable or platform rule format, kept in version control, tested before release, deployed to the SIEM or EDR, then tuned and measured against MITRE ATT&CK. The category spans detection-as-code pipelines and formats (Sigma, Panther's Python rules, Anvilogic), shared detection content (SOC Prime, Splunk Security Content), detection posture and coverage management (CardinalOps, Tidal Cyber, DeTT&CT) and purple-team trackers that record whether each tested technique was detected (VECTR). It sits beside the SIEM, which runs the rules; breach & attack simulation, which fires the techniques that test them; and SOAR and MDR, which act on the alerts. Adversary emulation and purple teaming are deliberately not a separate area: the emulation tools are scored under breach & attack simulation, human-led red teaming under penetration testing, and the purple-team loop's output, a new detection and a measured coverage change, lands here. Commercial products are quote-only annual subscriptions, several with free community editions; the open-source toolchain is strong, but the largest rule libraries carry non-OSI licences (SigmaHQ rules use DRL 1.1, Elastic's detection rules Elastic License 2.0).
Pays off once a SIEM or EDR is running and alerts are triaged; before that, managed detection buys the outcome.
Advantages
- Detections become reviewable, testable code with change history and rollback instead of hand-edited SIEM rules
- ATT&CK coverage and rule-health measurement shows where detections are missing, broken or noisy
- Shared content libraries (SOC Prime, Splunk Security Content, SigmaHQ) shorten time-to-detection for new threats
- Sigma and rule-translation engines reduce SIEM lock-in and ease SIEM migrations
- Strong free options: pySigma, DeTT&CT and Splunk Security Content are open source; Tidal and VECTR offer free community editions
Trade-offs
- Adds a layer on top of SIEM/EDR spend, and its value depends on integrations with the platforms that run your rules
- Coverage maps measure mappings, not proof: detections still need testing through BAS or purple-team exercises
- Library content is generic and still needs local field mapping, testing and tuning
- Rapid consolidation (SnapAttack to Cisco in 2025, Panther to Databricks and CardinalOps to Cribl in 2026) leaves roadmaps and packaging uncertain
- Commercial products are quote-only, and key rule libraries carry non-OSI licences (DRL 1.1, Elastic License 2.0)
Open-source option
pySigma and sigma-cli (LGPL-2.1), DeTT&CT (GPL-3.0) and Splunk Security Content with contentctl (Apache-2.0) are active, self-hostable open-source building blocks; MITRE ATT&CK Navigator (Apache-2.0) handles coverage visualisation. You still assemble the pipeline yourself. No verified OSS project matches automated rule-health and tuning (CardinalOps) or purple-team tracking (VECTR Community Edition is free but EULA-licensed), and the SigmaHQ rules use DRL 1.1.
Vendors & tools in this area
Sigma-first detection content marketplace (Threat Detection Marketplace) plus Prime Architect (ex-Uncoder AI) rule translation.
Visit site →AI detection posture management: maps existing SIEM/EDR rules to ATT&CK and fixes broken or noisy rules; Cribl announced its acquisition in July 2026.
Visit site →Detection engineering platform: detection-as-code, ATT&CK maturity scoring and a 3,500+ rule library for SIEMs and data lakes.
Visit site →Detection-as-code SIEM: Python rules with unit tests, GitHub PR review and ATT&CK mapping; Databricks announced its acquisition in June 2026.
Visit site →Threat-informed defense platform that maps tools and detections to ATT&CK to show and prioritise coverage gaps; free Community Edition.
Visit site →Security Risk Advisors' purple-team tracker: logs each tested technique as detected/blocked, charts ATT&CK heat maps; free Community Edition.
Visit site →Vendor-neutral YAML detection rule format; pySigma and sigma-cli (LGPL-2.1) convert rules to SIEM queries; 3,000+ rules (DRL 1.1).
Visit site →Open-source (GPL-3.0) scoring of data-source quality, visibility and detection coverage against ATT&CK, output as Navigator layers.
Visit site →Splunk Threat Research Team's Apache-2.0 library of 2,000+ ATT&CK-mapped detections plus contentctl build/test tooling.
Visit site →ATT&CK detection-coverage record built from the rules your SIEM already runs; it measures coverage and does not engineer detections.
Visit site →