detection-as-code

A POC to implement Detection-as-Code with Terraform and Sumo Logic.

Microsoft Sentinel SIEM Log Source Analyzer

RuleVis is a powerful analysis tool that transforms your Wazuh ruleset into a dynamic, interactive force-directed graph. It helps you visualize the complex relationships between rules, identify critical dependencies, discover structural issues, and analyze the distribution of your rule IDs.

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.

Official, curated detection content (Sigma, YARA, IOC packs) for the Rustinel endpoint detection engine.

Infrastructure as code for CrowdStrike — manage detections, saved searches, lookup files, and more with a Terraform-like lifecycle.

A Python-native Detection as Code Framework

A Pythonic Detection Rules Framework

Sigma to Wazuh, Splunk and Sentinel from one source. Compiles 96% of SigmaHQ to Wazuh, refuses what it cannot translate faithfully, and ships 67 range-tested ATT&CK rules to prove it. MIT.

Automated Detection-as-Code (DaC) CI/CD pipeline for validating and programmatically deploying SIEM detection rules via GitHub Actions and the Wazuh API

Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.

A curated reference of threat detection engineering & incident response frameworks, tools, and detection rule sources.

A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.

Data Loss Prevention as Code: author Microsoft Purview DLP policies in a YAML DSL, compile and validate them offline, deploy through a reviewable simulation-first pipeline.

A helper for Wazuh Security Configuration Assessment (SCA) to create a custom SCA based on loosening.

The project utilizes of a wazuh-manager installed on WSL or a Linux machine, allowing testing custom rules locally before moving to production.

The detection engine: correlation rules on the event stream you already forward, outside the SIEM. Sequences across hosts in log time, state that survives a crash. Rust, no JVM, embeddable.

9 MITRE ATT&CK-mapped KQL detections on a live Microsoft Sentinel + Defender XDR environment (control-plane, endpoint, identity), with a PR-gated Detection-as-Code pipeline (GitHub Actions, OIDC), SOAR playbooks, and a SOC 2 control mapping.

A Panther Global Helper for enriching alerts using the Axonius CAASM platform