Collaborative Detection Engineering with Rulezet: Building a Trusted Community for Detection Rules

No ratings

Presented at Hack.lu 2025 by

Cruciani David

Théo Geffé

As threat landscapes evolve, managing and trusting detection rules has become as critical as creating them. Detection engineering teams struggle with rule duplication, inconsistent quality, false positives, and the lack of a trusted, community-driven repository to share validated rules. Rulezet is an open-source framework and platform designed to address these challenges. It provides a unified way to normalize, validate, and manage detection rules across multiple formats while fostering a collaborative ecosystem where rule authors, analysts, and engineers can review, evaluate, and improve detection logic together.