Detection As Code Python Packages

opentide

OpenTide — DetectionOps engine (PyPI package)

wazuhcoverage

A small batch CLI for measuring coverage in Wazuh JSON archives.

wazuhtester

wazuhtester is a Python library and command-line tool for interacting with the Wazuh wazuh-logtest daemon.

wazuhevtx

A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.

rulevis

RuleVis is a powerful analysis tool that transforms your Wazuh ruleset into a dynamic, interactive force-directed graph. It helps you visualize the complex relationships between rules, identify critical dependencies, discover structural issues, and analyze the distribution of your rule IDs.

wazuhscatune

A helper for Wazuh Security Configuration Assessment (SCA) to create a custom SCA based on loosening.

wresult

wresult provides the running configuration of a Wazuh agent by reconstructing how it applies ossec.conf and agent.conf.

wazuhtestgen

A tool to help detection engineers generate Wazuh rule tests either derived from INI test files from Wazuh repository, Windows Event Log (EVTX) files, or Wazuh rule files. The test format uses Python's unittest. It is designed to accompany wazuh-devenv project.

wazuhregex

wazuhregex is a Python package and command-line tool that implements Wazuh regex behavior for local testing and development. It lets you validate one pattern against all three Wazuh regex engines in one run.

sigmalint-cli

ESLint-style linter for Sigma detection rules. Validates against Sigma 2.1.0, scores rules across six quality dimensions, emits stable rule IDs.