One YAML rule, any SIEM: introducing DetectForge

说明与用途

DetectForge 允许使用单个 YAML 规则生成多种 SIEM 平台的查询，消除重复并提高一致性。

问题

Detection teams duplicate logic across SIEMs, writing identical rules in multiple query languages.

结果

DetectForge enables a single YAML rule to generate queries for multiple SIEMs, eliminating redundant rule authoring and improving consistency.

工作流

• Write a single YAML rule with metadata and detection logic.
• Use DetectForge to parse the YAML into typed objects.
• Validate the rules with DetectForgeValidator to catch errors such as duplicate keys or missing identifiers.
• Apply collections to resolve shared metadata and rule references.
• Run the processing pipeline for field mapping, transformations, and per‑rule conditions.
• Convert the processed rules to platform‑specific query text via a backend (e.g., TextQueryBackend).

证据

Every detection team I have talked to ends up in the same place: the same detection logic written four times.

来源

DetectForge is my attempt at the boring-but-important layer underneath that problem.

来源

Duplicate keys are rejected, not silently merged.

来源

RE2 is the default regex engine.

来源

Rule YAML → typed objects → collection (globals applied, references resolved) → processing pipeline (field mapping, transformations, per‑rule conditions) → backend → query text.

来源