A community where detection engineers can
Used by 18,000+ detection engineers
Detection engineering is isolated
For too long, building detections has meant starting from scratch — isolated, under-resourced, and disconnected from the broader community doing the same work.
Detection engineering deserves better
Every team starts from scratch.
Chase the same threat intel.
Detections don’t travel between SIEMs.
Knowledge doesn’t compound across teams.
New threats get covered late, everywhere.
We builtto fix this
No more starting from scratch
Someone already wrote it. Find it. “Borrow” it. Make it yours.
Browse rules built by engineers who faced the same threats you are facing right now.
Evolve together.
Outpace the threat.
The platform built around its contributors
Contributions are visible, improvement is continuous, and the collective output moves faster than any single team ever could.
Contribute and discover
Browse 20,000+ detections across Sigma, KQL, SPL, YARA, YARA-L, S1QL, Cortex QL, CQL, and Suricata. Save what you need, publish what you build, and translate across all 9 languages. We’re always adding more.
Groups and collaboration
Create or join public, private, or invite-only groups. Share detections with your team, your organization, or the entire community. Build together without the friction.
Generate detections from intel
Paste an Intel Report, blog post, or threat actor profile. AI drafts the detection and refines the logic with you turn by turn. Chat history persists, so you can pick up where you left off.
Come build with us
Join the community that moves faster than the threat.
Running a detection team? See Enterprise →