Leonidas vs Query.AI Federated Detections: Side-by-Side Comparison (2026)

Leonidas: A framework for executing cloud attacker tactics, techniques, and procedures (TTPs) that can generate APIs, Sigma detection rules, and documentation from YAML-based definitions..

Query.AI Federated Detections: Runs security detections across distributed data sources without SIEM ingestion. built by Query.AI. Core capabilities include Federated detection execution across distributed data sources without ETL or data centralization, Detections authored in Federated Search Query Language (FSQL) with windowed aggregations, grouping, and threshold logic, Deterministic, scheduled detection execution with recorded evaluation windows and audit metadata..

Both serve the Detection Engineering market but differ in approach, feature depth, and target audience.

Leonidas is open-source with 593 GitHub stars. Query.AI Federated Detections is developed by Query.AI. Vendor maturity, funding stage, and team size can be important factors when evaluating long-term viability and support quality.

Leonidas and Query.AI Federated Detections serve similar Detection Engineering use cases: both are Detection Engineering tools, both cover Detection Rules, Sigma. Key differences: Leonidas is Free while Query.AI Federated Detections is Commercial, Leonidas is open-source. Review the feature comparison above to determine which fits your requirements.