Terms of Service

Defection provides a free, publicly available web browser for detection engineering: browsing Sigma detection rules, mapping coverage against the MITRE ATT&CK framework, and viewing technique, group, software, and campaign intelligence. The free service is open to everyone and requires no account.

Defection does not offer public sign-up, self-serve subscriptions, or online checkout. There is no consumer account to create and nothing to purchase on this site. Any access beyond the free browser is provisioned only through a Defection professional-services engagement.

Paid detection engineering — coverage assessments, detection tuning, and deployment-ready SIEM content (the defection-alert Splunk app) — is delivered as a professional-services engagement. Each engagement is governed by a Master Services Agreement (MSA) and, where personal data is processed, a Data Processing Agreement (DPA) executed between Defection and the client; the specific scope is set in a Statement of Work (SOW). Those documents, not these Terms, govern the engagement.

Where an engagement requires processing client tuning data (for example hostnames, IP addresses, or email addresses), that processing occurs client-side in the operator’s own browser session, and no Defection server receives, decrypts, or stores that data in plaintext. The Data Processing Agreement sets out the full processing terms for that engagement, including data retention, deletion, and its restrictions on transmission of tuning data to third-party analytics, error-reporting, or monitoring services.

You may not use Defection for any unlawful purpose, to facilitate attacks on third parties, or to circumvent security controls. Automated tooling against the free browser that degrades the service for others is not permitted.

The Defection platform, its catalog, enrichment data, and service output (including rule metadata, coverage mappings, and conversion results produced by the service) may not be redistributed, republished, or used to build a competing catalog or detection-conversion service. This restriction applies to Defection’s own proprietary additions and service output; it does not restrict your rights under the upstream open-source licenses governing the underlying rule text (including the SigmaHQ Detection Rule License and ESCU Apache 2.0).

Sigma rules and MITRE ATT&CK data displayed in the browser are sourced from open-source projects under their respective licenses. Detection conversion in the free browser runs entirely client-side; nothing you convert is transmitted to or stored by us.

The Defection platform, branding, and all proprietary software are owned by us. Nothing in these Terms transfers any intellectual property rights to you.

The free service is provided “as is” without warranty of any kind. Detection rules are provided for informational purposes — you are solely responsible for validating their effectiveness in your environment. To the maximum extent permitted by law, our aggregate liability arising out of or related to the free service is limited to zero, as it is provided at no charge. Liability for paid professional-services work is governed exclusively by the applicable MSA.

These Terms are governed by the laws of the State of Colorado, United States, without regard to its conflict-of-laws rules. Any dispute shall be subject to the exclusive jurisdiction of the state and federal courts located in Colorado.

We may update these Terms from time to time. The effective date above reflects the latest revision. Continued use of the free service after that date constitutes acceptance.

Questions about these Terms: legal@defection.io.