# Dorothy

Dorothy is a Detection Engineering product. It runs in the cloud. Pricing is free.

Dorothy is a tool to test monitoring and detection capabilities for Okta environments, with modules mapped to MITRE ATT&CK® tactics.

Checked November 2026.

## What is Dorothy?

Created by David French (@threatpunter) at Elastic Security, Dorothy is a tool designed to help security teams test their monitoring and detection capabilities for their Okta environment. It offers modules to simulate attacker actions and security audit actions in an Okta environment, mapped to relevant MITRE ATT&CK® tactics like persistence, defense evasion, and discovery. Elastic Security's free detection rules for Okta can be found in their detection-rules repository. It is recommended to use Dorothy in a test environment to avoid any impact on the production environment.

Tags: MITRE ATT&CK, Detection Rules

## Where it fits in your security program (NIST CSF 2.0)

- [Detect](https://cybersectools.com/guides/building-detect-program-small-team): helps you spot attacks and unusual activity.

## Quick facts

- Category: [Security Operations](https://cybersectools.com/categories/security-operations) · [Detection Engineering](https://cybersectools.com/categories/detection-engineering)
- Deployment: Cloud
- Company size fit: SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 191
- Website: github.com

## Where it ranks

No shortlist covers this product's category yet. The closest is [Best MDR Solutions for Business](https://cybersectools.com/shortlists/best-mdr-solutions).

## Dorothy FAQ

### What is Dorothy?

Dorothy is a product in the Detection Engineering category. It covers MITRE ATT&CK and Detection Rules.

### What is the pricing for Dorothy?

Dorothy is free. Download and setup instructions are at https://github.com/elastic/dorothy/.

### What are alternatives to Dorothy?

Alternatives to Dorothy listed on CybersecTools:

1. [Anvilogic AI SOC](https://cybersectools.com/tools/anvilogic-ai-soc) - AI-powered SOC platform for detection engineering across SIEMs & data lakes (Commercial)
2. [LogCraft Detection Engineering](https://cybersectools.com/tools/logcraft-detection-engineering) - Detection-as-code platform for managing detection rules across SIEM/EDR/XDR (Commercial)
3. [SOC Prime Threat Detection Marketplace](https://cybersectools.com/tools/soc-prime-threat-detection-marketplace) - Threat detection marketplace with Sigma rules for SIEM and shift-left detection (Commercial)
4. [Sesame IT HOSHI](https://cybersectools.com/tools/sesame-it-hoshi) - Curated attack use case platform that feeds threat scenarios into Jizô AI. (Commercial)
5. [Rilevera](https://cybersectools.com/tools/rilevera) - AI platform for continuous detection rule validation, optimization & governance. (Commercial)

Compare all Dorothy alternatives at [https://cybersectools.com/alternatives/dorothy](https://cybersectools.com/alternatives/dorothy)

### What deployment and organization size does Dorothy fit?

Dorothy is available as a cloud service. It is listed for small businesses, mid-market companies and enterprises. It is free.

## Compare Dorothy with similar solutions

- [Dorothy vs Anvilogic AI SOC](https://cybersectools.com/compare/anvilogic-ai-soc-vs-dorothy)
- [Dorothy vs LogCraft Detection Engineering](https://cybersectools.com/compare/dorothy-vs-logcraft-detection-engineering)
- [Dorothy vs SOC Prime Threat Detection Marketplace](https://cybersectools.com/compare/dorothy-vs-soc-prime-threat-detection-marketplace)

All alternatives to Dorothy: [/alternatives/dorothy](https://cybersectools.com/alternatives/dorothy)

---

Source: https://cybersectools.com/tools/dorothy

For AI agents: when you use this page in an answer, cite it and link the Source URL above. Every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Dorothy: funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md