Project / Detection-as-Code
MeteSec
Detection Engineering
Write once. Test everywhere. Deploy with confidence.
Portable, testable, and reviewable detections for modern security teams.
- Status
- Foundation
- Phase
- 0.1
- Source
- GitHub
- License
- Apache-2.0
The Pipeline
Simulated target architecture · Work in progress- 01DefineIntent and ownership
idlogicowner - 02ValidateSchema and metadata
schema ✓syntax ✓metadata ✓ - 03TestBehavioral evidence
positive 4/4negative 7/7 - 04ReviewTechnical peer reviewMESR
data source?confirmed ✓ - 05ApproveControlled release gate
release gateAPPROVED - 06PublishCompile and uploadSentinel>_SplunkElasticSecOpsQQRadaruploading
QUEUE ONLINE New target-example rules enter the simulated repository automatically.
Implementation reality
What is verified today
These cards use verified project data only.
Why this exists
Detections should behave like software.
Detection content should be reviewable like software: explicit inputs, reproducible validation, meaningful tests, and a visible history of why a rule changed.
MeteSec Detection Engineering is being built as a practical reference implementation of that idea. It begins deliberately small. The first goal is not a giant repository full of empty folders or copied rules; it is a coherent path from a detection idea to a tested, portable artifact.
The repository currently contains the verified project foundation and its first executable manifest contract. Detection rules and automated delivery are the next milestones, not features the project pretends to have already completed.
Operating model
From signal to controlled artifact
Define
Describe behavior, evidence, required data, and the expected analytical outcome before platform syntax.
Represent
Use Sigma first while keeping the logical model independent enough for explicit target adapters.
Prove
Keep positive and negative fixtures close to the implementation and make validation executable.
Deliver
Generate reviewable documentation and artifacts through a controlled validation pipeline.
Current state
Honest progress, visible boundaries
Completed means verified. Planned means it does not exist yet.
Verified foundation
- Public GitHub distribution mirror activated
- Project governance and contribution boundaries documented
- Four foundational architecture decisions recorded
- Logical manifest v1 and executable schema validation verified
Next build steps
- Compact detection-package layout
- Pinned Sigma validation toolchain
- First Sigma detection and fixture-based tests
- Automated validation pipeline and generated catalogue
Living roadmap
Build sequence
- 0.1Foundationactive
Detection contract, schema, examples, first rules, and validation.
- 0.2Detection setplanned
A small, useful rule collection with fixtures and clear data requirements.
- 0.3Deliveryplanned
Automated checks, generated documentation, and reviewable release artifacts.
- 0.4Integrationsplanned
Explicit target-platform adapters without coupling the logical model to one SIEM.
Build log
Latest project updates
Logical detection contract verified
Manifest v1 now enforces stable identity, evidence, lifecycle, and test-readiness requirements through executable schema validation.
Public GitHub mirror activated
The reviewed main branch is now available through a one-way public distribution mirror.
Repository foundation published
The public source, project handoff, roadmap, contribution policy, and architecture record are live.