Eight formats
YARA, Sigma, Splunk SPL, QRadar AQL, SentinelOne, KQL, Suricata and EQL.
HUNT YARA, Sigma, Splunk, QRadar, SentinelOne, KQL, Suricata, EQL
Hunting Rules
A detection rule corpus in eight formats, filtered by name, author, content, rule type, severity, MITRE technique and date range, and downloaded one by one or in bulk.
Screenshots are taken from a demo tenant; organisation names and data are entirely fictional.
Bulk download produces a separate text file per rule, folders them by rule type and adds an index.json manifest, so your CI pipeline or SIEM import script reads the structure directly. Rules can also be filtered by APT group and pulled page by page through the API.
What it does
MITRE filter
Pick rules by technique ID such as T1059.001.
Zip with manifest
Folder-structured rules and index.json in one file.
What you get
- Detection engineers stop translating rules by hand.
- The rule set is chosen by your threat model.
- Rules enter version control on a schedule.
Next step
What shows up on your own surface?
In a 30-minute session we run a live scan against your own domains.