Detection-as-Code Copilot

Author Sigma detections in VS Code with the checks a senior detection engineer makes by reflex — false-positive smells, ATT&CK validation, Sigma→KQL compilation, and a backtest you can run without any cloud access — all in the editor, before the rule ships.

Features

• False-positive lints, live. Flags match-all fields, single-field low-entropy selections, missing exclusion terms, and un-tagged rules as you type.
• ATT&CK validation. Technique IDs are checked for format and existence, so a bogus attack.t9999.001 gets a red squiggle instead of poisoning your coverage story.
• Sigma → KQL. Compile the current rule to table-qualified KQL (Detection Copilot: Compile to KQL).
• Offline backtest. Point detectionCopilot.sampleDataset at a JSONL of synthetic or de-identified events and run Detection Copilot: Backtest against sample events. Get hit count and fire rate; noisy rules are flagged. No Log Analytics, no credentials, PHI-safe — evaluation happens entirely on your machine and no log rows ever leave it.

Requirements

The intelligence runs in a small Python language server. Install it once:

pip install detection-copilot-server

The extension launches it automatically. If it isn't found, the extension tells you how to install it rather than failing silently. To run the server from a specific interpreter, set detectionCopilot.pythonPath.

Quick start

1. pip install detection-copilot-server
2. Open a .sigma.yml file (see examples/).
3. Edit — diagnostics appear live.
4. Set detectionCopilot.sampleDataset to examples/sample_events.jsonl.
5. Run Detection Copilot: Backtest against sample events from the palette.

Settings

Privacy

Detections and sample events are processed locally. The offline backtest never transmits log data anywhere. See the repository README for the full data-boundary design.

License

MIT.