detections

Every rule, and where it came from.

The public catalogue of detection rules. Every entry carries the source it came from, the identifier it had there, the licence it was published under and its ATT&CK mapping.

No paywall: everything above is public. A free account adds the detection logic itself — the query as its source wrote it, its canonical form, and the content hash that pins the exact revision — and a workspace to draft your own.

Public by policy

What you can see is a decision, not an oversight.

Everything above is published on purpose. What has not been published, and everything the catalogue is derived from, stays behind the same access controls whether or not you have an account — and none of what is shown needs one. Sign up when you want a workspace of your own.