6,000+ detections: SigmaHQ & Splunk ESCU libraries harmonized with MITRE intelligence to confront detection gaps from multiple angles. Click a rule to see its intel and SIEM-ready queries. All free.
Every Sigma rule, pre-converted to multiple SIEM query languages:
SigmaHQ and Splunk’s ESCU detections converged and updated, so you can browse all detections with unparalleled precision and perspective.
Open the browserTechniques, tactics, threat groups, campaigns, and software. All entity pages carry the detections that cover them against real adversary history.
View the matrixThe conversions are done before you arrive: most Sigma rules land in 10 or 11 of those languages. Open a rule, copy the query for your platform, paste it. ESCU analytics keep their native Splunk SPL.
Every technique reference attached to its MITRE Detection Strategies, CAR analytics, Mitigations, and Atomic Red Team tests.
See a technique