Detection Playgroundby Rayen Skhiri

// 29 detections · Cortex XQL · Splunk SPL · MITRE ATT&CK

Throw an attack at my detections.

Type a command line or paste a Sysmon event. Every rule runs right here in your browser, the same rules CI tests on every commit. Nothing you paste leaves this page.

Event

Waiting for input

Try one:

What the engine sees

Detections

// intrusion replay

From a phishing document to ransomware

Twelve real-looking steps across one morning on FIN-LAPTOP-07. One of them is normal admin work. Watch what fires.

    // coverage

    Every rule, by tactic

    Click a rule to load one of its test events into the playground.

    // how it is built

    One rule, three engines, one truth

    1. Written once. Each detection is a short YAML rule with test events that must fire and must not.
    2. Compiled. Python turns it into Cortex XDR XQL and Splunk SPL, with null guards so missing fields never hide an alert.
    3. Proven three ways. On every push, CI checks the rule, the compiled XQL and SPL, and this page's JavaScript engine against the same 800+ events. They must all agree.
    4. Shipped. Every push to main redeploys this page. Once CI is green, the XQL and SPL packs and the ATT&CK layer are published as a GitHub release.