Detection-as-code maturity matrix

14 platforms, 33 capabilities in six groups. Read from public pages on 2026-11-03, next full refresh 2027-02-03. Each row links to its profile; each column heading links to the capability definition.

Detection-as-code maturity matrix: platforms in rows, 33 capabilities in six groups in columns. Each cell reads documented, partial or not documented.
Platform	Languages										Source control and CI						Testing					Coverage analytics				Rule health					Library			Score
Platform	Sigma native	Sigma conversion	YARA-L	SPL	KQL	EQL or ES\|QL	Python	Visual builder	YARA	Lucene or KQL-like	Git sync	PR deploy	CLI	Rule API	CI examples	Env promotion	Unit tests	Replay	Synthetic events	Backtest reports	Test coverage	ATT&CK map	Gap view	Data sources	Log source health	Noisy rules	Broken rules	Field drift	Rule cost	Lifecycle	Library count	Community	Cadence	Score
Panther	not documented	documented	not documented	not documented	not documented	not documented	documented	documented	not documented	partial	documented	documented	documented	documented	documented	not documented	documented	documented	not documented	partial	not documented	documented	documented	partial	partial	not documented	documented	partial	partial	not documented	partial	documented	partial	18.0 / 33
Elastic Security	not documented	not documented	not documented	not documented	not documented	documented	not documented	not documented	not documented	documented	documented	partial	documented	documented	partial	partial	documented	documented	partial	not documented	not documented	documented	documented	partial	partial	not documented	documented	partial	documented	partial	partial	partial	partial	16.5 / 33
Google Security Operations	not documented	not documented	documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	documented	partial	documented	documented	not documented	not documented	not documented	documented	partial	partial	not documented	documented	documented	partial	partial	partial	documented	not documented	documented	documented	partial	documented	partial	15.0 / 33
Splunk Enterprise Security (Cisco)	not documented	not documented	not documented	documented	not documented	not documented	not documented	not documented	not documented	not documented	documented	partial	documented	not documented	documented	not documented	documented	partial	documented	partial	not documented	documented	partial	partial	documented	not documented	partial	not documented	not documented	documented	documented	not documented	partial	13.5 / 33
Microsoft Sentinel	not documented	not documented	not documented	not documented	documented	not documented	not documented	not documented	not documented	not documented	documented	documented	not documented	documented	documented	partial	not documented	documented	not documented	not documented	not documented	documented	documented	partial	partial	not documented	documented	not documented	partial	not documented	partial	documented	not documented	12.5 / 33
Sigma and pySigma	documented	documented	partial	documented	documented	documented	not documented	not documented	not documented	documented	not documented	not documented	partial	not documented	partial	not documented	not documented	not documented	not documented	not documented	not documented	documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	documented	documented	documented	partial	12.0 / 33
Sekoia.io	documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	not documented	not documented	not documented	documented	not documented	not documented	partial	documented	not documented	partial	not documented	documented	partial	partial	partial	partial	partial	not documented	partial	documented	documented	not documented	partial	11.0 / 33
Anvilogic	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	partial	not documented	partial	not documented	partial	partial	partial	not documented	partial	partial	partial	not documented	not documented	partial	partial	not documented	partial	6.5 / 33
Hunters	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	documented	not documented	not documented	not documented	documented	documented	partial	partial	partial	not documented	not documented	not documented	partial	partial	not documented	partial	6.5 / 33
SOC Prime	partial	partial	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	not documented	not documented	not documented	partial	not documented	not documented	not documented	not documented	not documented	not documented	partial	partial	partial	not documented	not documented	not documented	not documented	not documented	not documented	partial	partial	partial	5.0 / 33
Detecteam	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	not documented	partial	not documented	partial	not documented	partial	partial	partial	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	not documented	not documented	3.5 / 33
Mate Security	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	partial	not documented	partial	partial	partial	not documented	not documented	partial	partial	not documented	not documented	3.5 / 33
CardinalOps (Cribl)no longer ships under this name	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	partial	partial	partial	partial	partial	partial	partial	not documented	not documented	not documented	not documented	not documented	3.5 / 33
SnapAttack (Cisco)no longer ships under this name	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	not documented	0.0 / 33

documentedpartialnot documented

Rows are ordered by matrix score (documented counts 1, partial 0.5, of 33), ties broken by rubric total. The group set apart by the heavy rule is rule health: noisy rules, broken rules, field drift, rule cost, lifecycle. The score counts public evidence. It does not grade quality.

What the matrix shows

Coverage analytics is the best documented group across the 14 platforms, at 52 percent of the cells. Languages is the least documented, at 13 percent. A rule that stops running or floods the queue is the failure a detection team meets most often, and it is the part the public pages describe least.

The rule-health columns are where the platforms differ most. Platforms documenting each, of 14: noisy rules 0, broken rules 4, field drift 0, rule cost 2, lifecycle 4. The rule-health page carries the quotes behind each cell.

The rubric ranking

The matrix counts what is documented. The rubric weights eight criteria that sum to 100 and scores each from 0 to 10, so a platform with strong repository and rule-health documentation outranks one with a long language list. Totals within 0.25 of each other are a band, not a ladder.

Rubric totals out of 10 for the 14 scored platforms, with the matrix score beside each.

#	Platform	Rubric total, of 10	Band	Matrix score
1	Microsoft Sentinel	7.81	band A	12.5 / 33
2	Elastic Security	7.60	band A	16.5 / 33
3	Google Security Operations	6.83		15.0 / 33
4	Panther	6.31	band B	18.0 / 33
5	Splunk Enterprise Security (Cisco)	6.21	band B	13.5 / 33
6	Sigma and pySigma	5.50	band C	12.0 / 33
7	Anvilogic	5.48	band C	6.5 / 33
8	Detecteam	5.26	band C	3.5 / 33
9	SOC Prime	5.11		5.0 / 33
10	SnapAttack (Cisco) (scored, not profiled)	4.61		0.0 / 33
11	Mate Security	3.98	band D	3.5 / 33
12	CardinalOps (Cribl) (scored, not profiled)	3.96	band D	3.5 / 33
13	Sekoia.io	3.46	band E	11.0 / 33
14	Hunters	3.44	band E	6.5 / 33

Band A: Microsoft Sentinel 7.81, Elastic Security 7.60. Spread 0.21.
Band B: Panther 6.31, Splunk Enterprise Security (Cisco) 6.21. Spread 0.10.
Band C: Sigma and pySigma 5.50, Anvilogic 5.48, Detecteam 5.26. Spread 0.24.
Band D: Mate Security 3.98, CardinalOps (Cribl) 3.96. Spread 0.02.
Band E: Sekoia.io 3.46, Hunters 3.44. Spread 0.02.

Where Mate Security sits

Mate Security scores 3.98 of 10, eleventh of 14 scored and tenth of 12 profiled. In the matrix it documents 3.5 of 33 capabilities, level with Detecteam and CardinalOps (Cribl). Its best criteria are coverage analytics and rule health, both read from its own platform page and so vendor claims with no stated method. 4 of the other 13 platforms document more rule health than it does.

The Mate Security page says what the product is described as doing. This site scores only what is published, and says where nothing is. Read the Mate Security profile.

Method and data

The rubric page sets out the eight criteria and how totals are computed. The matrix method explains how the 14 by 33 grid was read. Download the grid as CSV or JSON, or read the dataset page.