RuleCheck

RuleCheck is a detection quality assurance (QA) platform focused on Elastic Security detection rules. It automates the testing and review of detection rules and queries, identifying issues related to rule structure, query logic, version compatibility, integration requirements, and operational state.

The platform goes beyond standard schema validation by evaluating query quality, Stack compatibility, integration prerequisites, deployed rule state, and historical alert behavior. It supports 56 distinct checks across the full detection lifecycle — from pre-deployment content validation to post-deployment operational verification.

RuleCheck integrates with Git repositories, GitHub, and Kibana environments. It offers a CLI and GitHub Actions support for pull-request validation workflows. Kibana connectivity is optional; static checks operate directly from source content, while live and historical checks require a Kibana connection to validate deployed rule state, query execution, and alert volume.

Target customers are security engineering teams managing large portfolios of custom, forked, or community Elastic detection rules across multiple repositories and environments. The platform also parses Sigma rules, extending some checks beyond Elastic-specific content.

RuleCheck is offered as an annual subscription priced at $15,000/year (founding customer pricing), covering up to 1,000 active rules and two Elastic environments. A complimentary baseline review is available to selected teams, including static checks, optional live Kibana validation, and a findings walkthrough session.

The company also publishes "Detections Digest," a weekly newsletter aggregating detection rule changes from 50+ public GitHub repositories, with over 1,500 subscribers.