Free to read. Pay to deploy.
Every rule's context is public, so you can tell whether the library covers your threats before it costs anything. What you pay for is the detection logic itself.
Browse
Free for everyone
$0forever
Threat context, ATT&CK mappings, log sources and known limitations — plus 3 unlocks to read the logic itself, on the house.
Pro
For one hunter
$19.99/ month
Copy and download the logic in standard formats, and keep it current as rules change.
Team
For teams and products
$49.99/ month
+ $9.99 / seat / month
Shared unlock history across the team. Rule retrieval over the API is on the roadmap, not shipped.
Never miss a new rule.
The same daily note that carries new detections to the library, the moment they're reviewed and published.
Before you ask
One unlock per rule, spent the first time you reveal, export or retrieve its detection logic. Pro includes 25 a month; Team includes 60 per seat. Reading the public page for that rule costs nothing, and re-opening a rule your organisation has already unlocked costs nothing either. You will always be told before an unlock is spent.
Yes — 3 of them, once, as soon as you sign in and claim them. No card, no trial that expires. They are there because you should not have to take our word for what the detection logic looks like: spend them on the rules you actually care about, and decide from the real thing rather than from this page. They do not expire with any cycle.
Because you cannot judge a detection library from a marketing page. Everything you need to decide whether a rule is relevant to your environment — the behaviour it covers, the telemetry it needs, where it will misfire — is public. Only the logic itself sits behind an unlock.
Pro is one person: 25 unlocks a month, and the logic in your hands to copy, download and keep current. Team is a base subscription plus a fee per seat, shares one unlock history across everyone in it, and includes 60 unlocks a month for every seat — so the allowance grows with the team rather than being divided by it. Rule retrieval over the API is planned for Team and is not available yet.
You can buy a pack of 10 at any time, on any plan, and the credits do not expire at the end of the cycle. A pack is priced for the month you went over, not as a way to live without a plan: if you are regularly running out, the next tier up costs less per unlock than repeat packs.
Rules you unlocked while subscribed stay available to your organisation. Cancelling stops new unlocks and renewal; it is not a rollback of what you already paid for.
They are written for it, but no rule is production-ready in an environment it has never seen. Reviewed means a person checked the logic, the source fidelity and the metadata. It does not mean the thresholds suit your estate. Run a rule in audit mode and tune it before it pages anyone.