Tools

I build open-source detection engineering tools under Detect-Forge – AI-native, CI-native, and inspectable. Everything runs locally or in GitHub Actions; no data leaves your environment. Opt-in LLM features are BYOLLM (your API key, your model choice).

pip install detect-forge

detect-forge stale

Your detection rules are probably stale, and you don’t know it. stale audits Sigma rule repositories for freshness across three dimensions: timestamp drift against MITRE ATT&CK (deterministic), semantic drift between rule logic and current technique descriptions (local embeddings), and optional LLM-generated diff proposals to close the gap. Green CI tells you your rule parses – stale tells you whether it still matches reality.

→ GitHub · The blog post that started it

detect-forge backtest

Catch noisy rules before they fire in production. backtest runs Sigma rules against the Atomic Red Team EVTX corpus and scores them the way a quant scores a trading signal: precision, recall, F1. Empirical evidence for what a rule catches — and what it doesn’t — before it ships.

→ GitHub

The SaaS (coming soon)

A hosted dashboard for detect-forge stale is coming in late 2026 — continuous staleness monitoring across your rule repos, with history, alerts, and team views. Newsletter subscribers get first access:

Join the waitlist →

New tools ship with an announcement to the newsletter 24 hours before the public launch, and get discussed first in the Machine Learning in Security Discord.