Rules as code alongside the visual builder

Hi,

Today: rules can only be built and maintained in the visual builder.

Problem: nested AND/OR/NOT logic is slow to assemble and hard to read back; changes can't be reviewed as a diff; rules can't live in Git alongside the rest of our infrastructure config; promoting configuration between environments means manual re-creation and drift.

Request:

• Text representation of rules — a DSL or structured YAML/JSON — with two-way sync to the builder
• Syntax validation and a dry run against historical or mirrored traffic before publishing
• Versioning with diff and rollback

Benefit: ccomplex rules creation and maintenance, code review and CI/CD for detection rules, reproducible configuration, fewer manual-entry errors, audit-ready change evidence, fast promotion between environments

Thank you for sharing this feedback. We recognize the challenges involved in managing and configuring complex rules, particularly the scenarios you outlined.

MCP is already on our roadmap and is planned for release soon. Once available, it may provide a useful way to explore some of these rule-management use cases. We welcome you to try it and share your feedback, which will help us better understand your requirements.

Hi,
Do you plan to add a rule syntax field instead of a rule builder? Or only MCP server?