One YAML rule, any SIEM: introducing DetectForge

Описание и применение

DetectForge позволяет писать одну YAML‑правилу, которая генерирует запросы для разных SIEM‑платформ, устраняя дублирование и повышая согласованность.

Задача

Detection teams duplicate logic across SIEMs, writing identical rules in multiple query languages.

Результат

DetectForge enables a single YAML rule to generate queries for multiple SIEMs, eliminating redundant rule authoring and improving consistency.

Рабочий процесс

• Write a single YAML rule with metadata and detection logic.
• Use DetectForge to parse the YAML into typed objects.
• Validate the rules with DetectForgeValidator to catch errors such as duplicate keys or missing identifiers.
• Apply collections to resolve shared metadata and rule references.
• Run the processing pipeline for field mapping, transformations, and per‑rule conditions.
• Convert the processed rules to platform‑specific query text via a backend (e.g., TextQueryBackend).

Доказательства

Every detection team I have talked to ends up in the same place: the same detection logic written four times.

Источник

DetectForge is my attempt at the boring-but-important layer underneath that problem.

Источник

Duplicate keys are rejected, not silently merged.

Источник

RE2 is the default regex engine.

Источник

Rule YAML → typed objects → collection (globals applied, references resolved) → processing pipeline (field mapping, transformations, per‑rule conditions) → backend → query text.

Источник