Field note · Logged September 2026
Detection-as-code explained
Treating detection rules like software.
Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18
About 1 minutes
What are the parts of a detection-as-code workflow?
| Practice | What it means | Why it matters |
|---|---|---|
| Version control | Rules live in a repository; every change has an author and a history | You can see who changed what and revert |
| Review | Changes are approved by a second person | Catches logic errors before they ship |
| Testing | Rules run against sample or historical data before deploy | Measures noise and misses in advance |
| CI/CD | Tests and deployment run automatically on merge | Removes manual copy-paste into consoles |
| Rollback | A bad change can be undone quickly | Limits the cost of mistakes |
Which tools in this guide support detection-as-code?
| Tool | DAC score | What the vendor publishes | Our reason |
|---|---|---|---|
| Anvilogic | 9 | "Detection-as-Code with version control" | Detection-as-code with version control is stated on the platform page. |
| Nebulock | 8 | Immutable version history, GitHub export, required retrohunt | Immutable version history with compare and revert, GitHub export, and a required retrohunt before deployment. |
| Vega | 8 | "Detections live in source control, reviewed like any other code change" | Detections live in source control, each change with a diff, an author and an approver. |
| CardinalOps | 8 | CI/CD support; rules delivered in native SIEM syntax or EDR formats | CI/CD support, with rules delivered in native SIEM syntax or EDR formats. |
| Cotool | 7 | "compatible with your existing detection-as-code infrastructure" | Compatible with existing detection-as-code tooling, with agent version control. |
| Mars Security | 6 | 30-day backtest on customer data; version control not described publicly | Backtests each rule on 30 days of the customer's own data; public pages do not describe version control or CI. |
| Artemis Security | 5 | Detections written and tuned automatically; no workflow described | Detections are written and tuned automatically; no detection-as-code workflow is described. |
Is backtesting the same as detection-as-code?
No, but it is one of its most valuable parts. A backtest runs a rule against past data to show what it would have caught. Mars Security's 30-day backtest and Nebulock's required retrohunt are both strong testing steps. Detection-as-code adds the rest: history, review and automated deployment.
Where does Sigma fit?
Sigma rules are plain text and not tied to one platform, which makes them a natural fit for a repository. Converters such as Sigma CLI and pySigma turn them into the query language of each platform at deploy time.
Source: github.com/SigmaHQ/sigma · Reviewed Sep 2026