Flagship open-source project
Detection Rules
One detection library. Nine security platforms. No single-platform gaps.
- Focus
- Flagship open-source project
- Updated
- June 2026
- Stack
- Python, Sigma, KQL, SPL, MITRE ATT&CK
Overview
Built for operational clarity.
A cross-platform detection engineering library built to make high-quality threat coverage portable across modern SIEM and EDR environments.
This project reflects a product-oriented approach to security engineering: start with a recurring operational problem, reduce unnecessary steps, and make the result usable across real environments.
What it delivers
01836 detection rules
029 target platforms
03152 MITRE ATT&CK techniques
04Release v1.3.0
Engineering approach
Portable, inspectable, and ready to operate.
The implementation emphasizes explicit workflows, deployable packaging, and technology choices that remain understandable to the teams running them.
PythonSigmaKQLSPLMITRE ATT&CK