Sources
Every indexed ruleset
Fifteen open-source detection projects. Each one is cloned, parsed into a common shape, and re-indexed hourly — the rules themselves stay in their own repositories.
Official Microsoft Sentinel community repo — KQL analytics, hunting queries, workbooks, playbooks.
Multi-platform community hunting queries — KQL, Sigma, SPL, ATT&CK-mapped.
Production-ready osquery detection queries organized by ATT&CK technique.
Official Google Chronicle community detection rules in YARA-L 2.0.
Official Elastic SIEM detection rules — TOML wrapping EQL/KQL/Lucene queries, mapped to ATT&CK.
Elastic's malware protection signatures — YARA rules plus behavioral EQL rules.
Proofpoint Emerging Threats Open ruleset — the de facto Suricata community rules. Daily-rebuilt tarball, ~50k rules across malware, exploits, scans, …
Official Falco rules — Kubernetes, containers, Linux syscall events, cloud-native threats.
Florian Roth's YARA rule collection — malware, APT, obfuscation patterns. Heavily referenced.
Python-native Detection-as-Code for Panther — AWS, GCP, Azure, Okta, GitHub, endpoint.
ReversingLabs threat intelligence converted to YARA rules.
Canonical Sigma rule repository — platform-agnostic detections that convert to 40+ SIEMs.
Community Wazuh rules supplementing the default ruleset shipped in Wazuh release packages.
Splunk's official ESCU — SPL searches with YAML metadata, mapped to ATT&CK and Cyber Kill Chain.
The rules shipped with the Wazuh agent. Indexed because the community Wazuh rulesets chain off these SIDs via if_sid.
Adding a source is deliberate rather than open — see about this index for how sources are chosen and how the data is built.