Observed arrival · 2026-08-29
Sunturai, a public catalogue of detection rules
Sunturai indexes 8,422 security detection rules, preserving each rule’s upstream source, identifier, licence, and ATT&CK mapping.
Field notes
The catalogue keeps upstream identifiers and licence information alongside each detection rule, making provenance part of the browsing experience rather than a hidden implementation detail. Its source breakdown covers SigmaHQ, Splunk, Elastic, and Microsoft Sentinel, while the ATT&CK view organizes entries across tactics such as Discovery, Credential Access, and Command and Control. The homepage reports 8,422 rules and says the underlying query text is available after free account creation.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue