Detection playground

Detection content on this site covers real sources (Sigma, Splunk SPL, KQL). A real engine evaluates them properly. This page is a deliberately reduced matcher — each rule pays attention to a couple of reliable substrings — so you can see the shape of detection engineering without it pretending to be a full SIEM.

Run rules Load sample that fires