Free to read. Pay to deploy.
Every rule's context is public, so you can tell whether the library covers your threats before it costs anything. What you pay for is the detection logic itself.
Start reading
for free
Pro
For one hunter
$49/ month
Copy and download the logic in standard formats, and keep it current as rules change.
Not open yet. The digest carries the announcement.
Team
For teams and products
$79/ user / month
Shared unlock history across the team, plus rule retrieval over the API.
Not open yet. Talk to us about volume.
Know the day the plans open.
The same daily note that carries new detections carries the announcement.
Before you ask
One unlock per rule, spent the first time you reveal, export or retrieve its detection logic. Pro includes twenty a month; Team's allowance is set with you. Reading the public page for that rule costs nothing, and re-opening a rule your organisation has already unlocked costs nothing either. You will always be told before an unlock is spent.
Because you cannot judge a detection library from a marketing page. Everything you need to decide whether a rule is relevant to your environment — the behaviour it covers, the telemetry it needs, where it will misfire — is public. Only the logic itself sits behind an unlock.
Pro is one person: twenty unlocks a month, and the logic in your hands to copy, download and keep current. Team is billed per user, shares one unlock history across everyone in it, sets its allowance with us rather than taking a fixed twenty, and is the only plan that can retrieve rules over the API.
Prices are set; the plans are not open yet. They are published now so you can budget for one rather than find out on launch day. The daily digest carries the announcement the moment sign-up opens.
Rules you unlocked while subscribed stay available to your organisation. Cancelling stops new unlocks and renewal; it is not a rollback of what you already paid for.
They are written for it, but no rule is production-ready in an environment it has never seen. Reviewed means a person checked the logic, the source fidelity and the metadata. It does not mean the thresholds suit your estate. Run a rule in audit mode and tune it before it pages anyone.