detection-as-code review
DetectionLint reads a rule the way a senior detection engineer would: it flags the logic that will page someone at 3am, scores the false-positive risk, and hands you a diff that keeps the intent.
what gets flagged
Every finding has a name, a severity and a line number, so a reviewer can argue with it. This is the full Sigma rule set; KQL, SPL, YARA-L and EQL carry their own.
missing-titleEvery Sigma rule must have a title.
missing-logsourceWithout a logsource the SIEM does not know where to apply it.
missing-conditionThe detection block has no condition.
condition-syntax-errorThe condition is not valid Sigma syntax.
unknown-selection-referenceThe condition names a selection that does not exist.
empty-selectionA selection with no predicates matches everything.
condition-always-trueA condition that references no selections is trivially true or false.
broad-process-no-parent-filterpowershell, cmd or rundll32 with no parent image filter.
unanchored-regexRegex without anchors gets expensive at SIEM scale.
single-wildcard-valueA bare "*" value matches everything.
extension-only-matchMatching only on file extension misses renamed binaries.
mutually-exclusive-valuesAND-ed equality on one field with different values can never match.
keyword-list-without-logsource-narrowingBare keyword lists match across the whole event.
unreferenced-selectionA selection block is never used in the condition.
missing-idRules should carry a stable UUID.
invalid-idThe id field is not a UUID.
missing-levelNo severity level declared.
deprecated-statusDeprecated or unsupported rules should be removed.
missing-attack-tagNo ATT&CK technique tag for coverage mapping.
cmdline-equals-instead-of-containsCommandLine usually wants |contains, not equality.
case-sensitive-match-on-windows-pathLowercase-only Windows paths miss attacker variations.
vague-descriptionThe description names an indicator, not the attack it catches.
Errors block the gate. Warnings and info lower the score and show up in the review.
where it runs
The same analyzer sits behind all three, so the score you see in the browser is the score your pipeline enforces.
/analyze
Paste or write a rule, see findings inline next to the line that caused them, and apply the suggested fix as a diff.
# findings L9 warning broad-process-no-parent-filter L1 info missing-attack-tag # suggest fix + ParentImage|endswith: '\winword.exe'
POST /api/analyze
Send rule source with your key and get the lint findings, false-positive score and ATT&CK techniques back as JSON.
curl https://detectionlint.org/api/analyze \ -H "Authorization: Bearer $DL_KEY" \ -d '{"source": "…", "language": "kql"}' # → overallScore, lint.findings, # fp.fpScore, meta.attackTechniques
POST /api/analyze/batch
Score a whole rules directory in one call from CI, fail the job under a minimum score, and put a quality badge in the README.
# ci step: fail under 80 min=$(curl -s …/api/analyze/batch \ -H "Authorization: Bearer $DL_KEY" \ -d @rules.json \ | jq '[.results[].overallScore] | min') [ "$min" -ge 80 ] || exit 1
how the score works
The overall score blends static lint (60%) with a model-scored false-positive estimate (40%). Static facts the analyzer already proved are passed to the model as ground truth, so it can't contradict them.
| language | where it runs | plan |
|---|---|---|
| Sigma | YAML, any backend | Free and paid |
| KQL | Microsoft Sentinel, Defender | Pro and up |
| SPL | Splunk | Pro and up |
| YARA-L | Google SecOps | Pro and up |
| EQL | Elastic | Pro and up |
public library
Curated rules from public repositories, each pre-scored with quality, false-positive risk and ATT&CK coverage. Fork one into your private library and keep reviewing from there.
pricing
Upgrade when you want every language, a private library, the API, or a gate the whole team shares.
For learning and one-off checks.
Solo detection engineers.
Detection teams, 3+ people.
20+ engineers, compliance-heavy.
Twenty analyses a month on the free plan, no card. Bring the rule that pages you most.