Artemis now keeps the detections your organization owns in GitHub, GitLab, Bitbucket Cloud, or Cursor Origin, and every change it makes reaches your team as a pull request.
Detection as Code is now generally available to every Artemis customer. Artemis acts as a detection engineer on your team. It keeps your organization’s detections in a repository you control and opens a pull request for every detection it creates or tunes, and each change merges once your team’s review allows it.
For teams that already manage detections in Git, Artemis becomes another contributor to the repository they use today. For teams that want to operationalize detection as code and lack the capacity, Artemis now writes and tunes detections and opens each pull request.
Detection as code takes more engineering time than most teams have
Detection as code brings the discipline of software engineering to security teams. When run well, every detection change is reviewed and tested before it reaches production, with a record of who changed it and why. This requires significant resources. Each detection needs its own tests, and the pipeline that tests and deploys detections needs constant upkeep. Most security teams do not have the bandwidth for that work on top of their daily operations. In the SANS 2026 State of Detection Engineering report, 72% of practitioners named time and resources as the biggest barrier to adopting detection as code.
Meanwhile, detection engineering keeps getting more difficult. Agents, ephemeral infrastructure, and automation accounts appear faster than anyone can write rules for them, and when detection engineers write and tune rules by hand, coverage decays between revisions. The repository can also drift from the SIEM, since a quick fix made in the console during an incident leaves the repository out of date until someone notices.
Artemis already writes and tunes detections for your environment
Artemis has four layers of detection:
- Managed detectors: A MITRE ATT&CK-mapped library of 3,000+ detectors covers known techniques.
- User Created Detectors: Detectors your team builds in the platform
- Adaptive detectors: Artemis writes these for your organization from a model of every user, account, device, and resource and how each one normally behaves.
- Intelligence detectors: Continuous hunts for emerging threats turn new threat research into detectors.
Before any detector goes live, Artemis validates it against your historical data and scores it for volume, overlap, accuracy, and efficacy. Once it is live, Artemis keeps tuning it as your environment changes, and every version is kept in an audit history you can roll back to.
Detection as Code covers any detection that belongs to your organization. That includes the adaptive detectors Artemis writes and the detectors it builds from threat intelligence, as well as the ones your team creates in AI Mode or imports from another platform.
Until now, teams could only review these detectors and their changes in the Artemis portal, outside the pull request process they use for code.
Detections Artemis writes and tunes now arrive as pull requests
Detection as Code works with GitHub, including GitHub Enterprise Server, as well as GitLab, Bitbucket Cloud, and Cursor Origin. Once it is turned on, your organization’s detections live in your repository, and changes move through the repository in both directions:
- Connect a repository: Choose a repository and branch, and Artemis opens a first pull request that adds your existing detections, organized by data source.
- See every change: When Artemis writes a new detection or tunes an existing one, it opens a pull request that explains the change and links back to the detection in Artemis.
- Merge on your terms: Your review rules decide what merges, and the running detection stays as it is until the pull request merges.
- Edit in your own tools: Your engineers can change detections in their own editor and merge them through the same pull request review they use for any other code, and Artemis picks up the change.
Teams can also use AI Mode to write a detector from a sentence or a threat report. Artemis checks it against your history and opens a pull request, and the detector goes live when your team merges it.
Detection changes from Artemis arrive as pull requests in your repository, each with an explanation and a link back to the detection.
Your review process stays in charge
Artemis follows the branch protection and required checks you already use, and it never bypasses them. Teams can choose how much to automate. Teams that want a person on every change can require an approval, and teams that would rather move faster can let changes from Artemis merge as soon as their required checks pass.
Built to support Cursor Origin from launch
Artemis is a launch partner for the Cursor Origin marketplace, and Detection as Code supports native Origin repositories from day one. Some of the most advanced security engineering teams in the world, including Cursor, already manage their detections as code with Artemis.
The connection runs through the Artemis app for Origin, and an Origin admin approves write access before Artemis can open pull requests. Detection changes then follow the same review flow as on any other host, with the repository’s required reviews and checks deciding when each one merges.
Get started
Detection as Code is available now to every Artemis customer, with support for GitHub, GitLab, Bitbucket Cloud, and Cursor Origin.
- Already an Artemis customer? Turn it on in Settings → Detectors → Detection as Code and connect a repository.
- Current customer and want the details? Read the Detection as Code setup guide.
- Not a customer yet? Request a demo to see Artemis open its first pull request in your repository.
