Method
How we score threat hunting tools
Seven criteria, fixed weights, public evidence only.
This edition covers 7 threat hunting and detection engineering tools scored on the same rubric.
CardinalOps was added on 2026-10-18 at the client's request. It is scored on the same rubric; as a detection engineering tool it scores low on hunt automation.
What do we score?
| Code | Criterion | Weight | What we look for |
|---|---|---|---|
| HNT | Hunt automation | 25% | Does the tool run hunts on its own, from new intelligence or from a hypothesis, continuously rather than on request? |
| FED | Works across existing SIEM and data lakes | 20% | Can it hunt across the SIEM, EDR, identity, cloud logs and data lakes a team already runs, without a new ingestion pipeline? Are the platforms named publicly? |
| EFF | Analyst effort saved | 15% | How much triage, investigation and rule-writing work does it take off analysts, as described in public material? |
| ATK | ATT&CK coverage evidence | 10% | Does public material show how coverage against MITRE ATT&CK is measured, such as a coverage view, scores or named tactics? |
| DAC | Detection-as-code workflow | 10% | Version control, review, testing or backtesting, and CI before a rule goes live. |
| DEP | Deployment | 10% | Published deployment model, time to first value, and security attestations. |
| PRC | Pricing transparency | 10% | Is there a published price a buyer can model before a sales call? |
Why these weights?
Hunt automation carries 25% because the reason to buy one of these tools is to hunt more often than a team could by hand. Working across existing SIEM and data lakes carries 20% because a hunt is only as good as the data it can reach, and moving data is slow and costly. Analyst effort saved carries 15%. The remaining four criteria carry 10% each: they separate good tools from each other but rarely decide on their own whether a tool fits.
What does each score level mean?
- 9 to 10: documented in detail on public pages, with specifics (named platforms, a described workflow, a stated figure).
- 7 to 8: clearly stated, with some specifics missing.
- 5 to 6: partly addressed, or stated only in general terms.
- 3 to 4: mentioned in passing, or addressed through a different mechanism.
- 1 to 2: not addressed on public pages, or the tool is built for a different job.
- Pricing transparency: 2 means no public price; 3 means some public cost tooling but no license price.
What counts as evidence?
Only material a buyer can read without a sales call: product pages, documentation, public GitHub repositories and the vendor's own press releases. Each vendor fact on this site has a source line with the page we used. Where a vendor does not publish something, we say “Not published” and score conservatively. Vendor performance figures are quoted as vendor claims, not verified results.
How is the data source grid built?
For each tool we list the data source types its public product pages or documentation name as hunted or queried in place: SIEM, EDR, identity provider, cloud logs, data lake or warehouse, and SaaS apps. A cell reads Named when a page we reviewed names a product or source in that category, and Not named otherwise. Not named means the page did not say it, not that the tool cannot do it. Reviewed September 2026.
How do we score ingestion and federated search?
Some tools query each source where it sits, often called federated search. Others copy some of the data into their own platform first, which is ingestion. Copying data in adds a second pipeline and a second store to run and pay for, next to a SIEM that already collects, stores and correlates the same events. Querying in place leaves the SIEM as the system of record. We score this under 'Works across existing SIEM and data lakes' (20%). This site does not rank or compare SIEM products; they appear only as data sources.
How are ties handled?
Totals are computed to two decimals. Equal totals share a rank and are listed alphabetically. In this edition Mars Security and Nebulock tie at 7.45.
What are the limitations?
- Public sources only. No hands-on testing, no trials, no vendor interviews, no customer interviews.
- Some vendor pages render content in the browser only; where we could not read a page, we did not use it.
- Scores reflect what vendors publish. A vendor with thin public documentation scores lower even if its product is strong.
- Facts can change after September 2026. Each page shows its review date.
- The rubric measures hunting on existing data; a detection engineering tool can score lower on hunt automation.
How often is this updated?
We re-check every vendor fact and score each quarter and log changes on this page. Corrections: contact us.
- 2026-10-18 · Edition updated. 7 tools scored.