One YAML rule, any SIEM: introducing DetectForge

Description and use

DetectForge lets you write a single YAML rule that generates queries for multiple SIEM platforms, eliminating duplication and improving consistency.

Problem

Detection teams duplicate logic across SIEMs, writing identical rules in multiple query languages.

Outcome

DetectForge enables a single YAML rule to generate queries for multiple SIEMs, eliminating redundant rule authoring and improving consistency.

Workflow

• Write a single YAML rule with metadata and detection logic.
• Use DetectForge to parse the YAML into typed objects.
• Validate the rules with DetectForgeValidator to catch errors such as duplicate keys or missing identifiers.
• Apply collections to resolve shared metadata and rule references.
• Run the processing pipeline for field mapping, transformations, and per‑rule conditions.
• Convert the processed rules to platform‑specific query text via a backend (e.g., TextQueryBackend).

Evidence

Every detection team I have talked to ends up in the same place: the same detection logic written four times.

Source

DetectForge is my attempt at the boring-but-important layer underneath that problem.

Source

Duplicate keys are rejected, not silently merged.

Source

RE2 is the default regex engine.

Source

Rule YAML → typed objects → collection (globals applied, references resolved) → processing pipeline (field mapping, transformations, per‑rule conditions) → backend → query text.

Source