Detection Workbench
Ten detection engineering tools, from log contract to shift handoff.
| Tool | What it does |
|---|---|
| Telemetry Contract BuilderCollect | OCSF 1.9.0 contracts that pass the official validator |
| Sigma ConverterWrite | SPL, KQL, Lucene and SQL, checked on 3,791 SigmaHQ rules |
| Sigma Rule TesterTest | Test, lint, fix and correlate; 471/471 SigmaHQ regression samples |
| Detection Pipeline LabTest | 13 detections, CI, precision and containment on a sample estate |
| Identity Anomaly FinderHunt | Baselines, tuning, suppressions, NDJSON alerts |
| Detection CoverageMeasure | ATT&CK heatmap, ranked gaps, Navigator layer |
| Alert Budget and Detection QualityMeasure | Precision and tune list from Sentinel, Splunk ES, Elastic, TheHive |
| Audit Log ExplainerRespond | One cloud, Windows or Sysmon event, or a whole .evtx file |
| SOC Shift DeskRespond | A full shift, exported to TheHive, DFIR-IRIS or STIX 2.1 |
| IOC EnrichmentRespond | Whole-report extraction, live verdicts, STIX and MISP export |
Background readingSigma rulesWhat a SIEM doesWindows event IDs
Quick workbench: analyze, rule library, coverageQuick workbench
Detection engineering FAQ
What is detection engineering?
Writing, testing and tuning the rules that turn logs into alerts, kept in version control and mapped to MITRE ATT&CK.
Do these tools upload my logs?
No. They run in the browser. The Sigma tools only download public SigmaHQ rules when you ask.
Which log sources are covered?
Any Sigma rule and JSON logs, with samples for CloudTrail, Okta, GitHub audit and Windows process creation. The anomaly finder reads Okta, Entra ID and CloudTrail.
Can I use these with AI-written rules?
Yes. The linter catches invented modifiers and field names, and labelled test events show whether the rule fires on the attack and stays quiet on the look-alike.
Sample logs are made up. SigmaHQ rules are used under the Detection Rule License 1.1 (snapshot 2026-10-06, live fetch for rule text). MITRE ATT&CK v19.2 is a trademark of The MITRE Corporation.