Security Operations
Detection as code tools you can grep (2026)
A 2026 shortlist of detection formats you can keep in git. Public repos, not a lab bake-off.
Expertise: Security Operations · Level: Intermediate · 12 min read
A detection that lives only in a console will die in the next upgrade.
The rule fired in staging and nobody can find the YAML. Detection as code means the query has a path, a reviewer, and a test. It is not a synonym for ‘we bought a lake.’
Six formats. One portable rule language. One host SQL. Two vendor content repos. One runtime rule engine. One open SIEM rule tree. Public repos and licenses. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Sigma | Portable detections you can convert | LGPL-2.1 (language) / Detection rules vary |
| osquery | SQL on the host you own | Apache-2.0 or GPL-2.0 (see repo) |
| Elastic detection-rules | Versioned Elastic SIEM content | Elastic License 2.0 |
| Splunk ESCU | Splunk security content you can pull | Splunk license / content terms |
| Falco rules | Runtime rules on syscalls you allow | Apache-2.0 |
| Wazuh rules | Decoders and rules on a SIEM you host | GPL-2.0 |
Sigma
Best for portable detections you can convert
Sigma is a YAML detection that converters turn into Splunk, Elasticsearch, or a SIEM you already have. The repo is the catalog.
Key features
- YAML rule format
- Converters for major SIEMs
- Huge public rule set
- You keep the files in git
Why we like it
This is the hidden gem of the job. If the SIEM changes, the YAML can still move. That is the point of the format.
Limits
A converter is not a guarantee. Fields differ. You still test the query on your indices.
osquery
Best for sQL on the host you own
osquery exposes the host as tables. Detections are SQL. Fleet and others schedule the queries. The project is open.
Key features
- SQL tables for processes, sockets, users
- Scheduled queries
- Extensions
- Works with Fleet and others
Why we like it
When the question is ‘is this binary still running,’ a SIEM query on a log you never sent will miss it. osquery asks the box.
Limits
You must deploy an agent. SQL that scans everything is a load problem. This is not a network IDS.
Elastic detection-rules
Best for versioned Elastic SIEM content
Elastic publishes detection-rules as a repo. Rules are TOML and have tests. That is detection as code for the Elastic SIEM.
Key features
- TOML rules in git
- Python test harness
- Mapped to Elastic SIEM
- Version history you can read
Why we like it
A vendor content pack that is actually a git repo is rarer than the brochure. You can fork and fail a test.
Limits
ELv2 is not Apache. The rules assume Elastic fields. They do not port to Splunk without work.
Splunk ESCU
Best for splunk security content you can pull
Splunk ESCU is the security content update. Research.splunk.com lists analytic stories. The bits live as SPL you can review.
Key features
- Analytic stories
- SPL you can read
- Mapped to data models
- Versioned content
Why we like it
If the SIEM is Splunk, this is the content shelf. Treat it as code you review, not as a score.
Limits
SPL stays in Splunk. You still need the data model. We did not subscribe to a paid workspace.
Falco rules
Best for runtime rules on syscalls you allow
Falco rules watch syscalls and Kubernetes audit. The rules repo is YAML condition language. Link the Kubernetes list for the engine.
Key features
- YAML conditions
- Syscall and K8s audit sources
- Allow and exception lists
- Open rules repo
Why we like it
Runtime is the hole SIEM YAML never sees. Falco is the open rule file for that hole.
Limits
It is not a historical SIEM. Noise is a tuning job. This page does not replay a container escape.
Wazuh rules
Best for decoders and rules on a SIEM you host
Wazuh ships decoders and rules as files. You can grep them. The SIEM alternatives list already covers the platform. This row is the rule tree.
Key features
- XML rules and decoders
- You can add a local rule file
- Tied to the Wazuh agent
- GPL-2.0
Why we like it
If you already operate Wazuh, the ruleset is the detection-as-code you have today. Do not pretend it is Sigma.
Limits
XML is not portable to Splunk. You own false positives. Link the SIEM list for the console job.
What the internet thinks about detection as code
Sigma import threads treat the YAML as a start, not a finished detection. We keep that line. A converter is not a tested query.
_8j50 on Hacker News, Jan 2023: “Importing Sigma rules is the easy part, it takes on average 2-3 hours of tuning a sigma imported rule to get it to where it is usable in a large environment.”
Prove a Sigma rule is a file
Clone the Sigma repo and list a rule file. You should see YAML, not a screenshot.
git clone --depth 1 https://github.com/SigmaHQ/sigma.git /tmp/sigma-prove
test -f /tmp/sigma-prove/README.md && echo OKFAQs
Is detection as code a product I buy?
No. It is a habit. The rows are formats and repos. A lake vendor that keeps rules in a GUI only is the wrong door.
Does Sigma replace my SIEM?
No. Sigma writes the idea of the query. A converter still needs indices and fields.
Why is Falco here and on Kubernetes?
The engine lives with the cluster. The rule files are detection as code. This page is the YAML. That page is the platform.
Is this a scored bake-off?
No. Order is editorial. We did not replay attacks.
