No Detection Locked to the Platform It Was Written On
Author detections and their attached Skills once, in a vendor-neutral format, and run them anywhere that honors the spec.
Portability Is the Whole Promise
Detection logic and Skills, portable to any platform.
Detection-as-Code Is a Team Practice, Not Just a File Format
Writing to the open spec means a detection review looks like a code review: diffed, versioned, and approved before it ships. Not just "your detections are portable," but "your detection team finally works the way your engineering team already does."
What the Open Spec Actually Buys You
Write once
A detection authored to spec doesn't need a rewrite for every new platform.
Version and review like code
Detections live in source control, reviewed like any other code change.
Portability you can verify
A detection declares what it needs to run anywhere, in one checkable contract.
Audit-ready by default
Every change has a diff, an author, and an approver.
No lock-in on your best work
The detections you're proudest of stay useful even if your platform changes.