Usage
Install OpenTide, learn the object model, and run detection-as-code — a guided path for detection engineers, agents, and integrators.
OpenTide is the DetectionOps engine: a versioned toolchain for building, validating, deploying, and documenting detection content as code across enterprise security platforms. This section takes you from "what is it?" to a working, CI-gated detection repository.
Start with the concepts
Detection content in OpenTide is a small graph of typed objects. Understanding that graph before you touch the CLI saves hours.
Pick your path
OpenTide serves several audiences. Follow the path that matches you.
| You are… | Start here | Then |
|---|---|---|
| New to OpenTide, greenfield repo | Installation → Repository setup | Tutorial → Detection-as-code |
| Checking what shipped | Releases | 0.1.0 on PyPI |
| Evaluating the project | Why OpenTide → How it works | Object model |
| Migrating from CoreTide | Migration guide | Configuration |
| Wiring up an AI agent | Agentic setup | MCP reference |
| Embedding OpenTide in Python | SDK | SDK registry |
The recommended read order
If you read one thing after another, read them in this order:
flowchart LR
why["Why OpenTide"] --> how["How it works"]
how --> model["Object model"]
model --> install["Install + setup"]
install --> tutorial["Tutorial"]
tutorial --> daily["Detection-as-code"]
daily --> ci["CI/CD"]
ci --> agents["Agents (optional)"]Everyday reference
- Configuration — credentials, enabling platforms, deployment plans, promotion.
- Troubleshooting — what to do when
validateorgeneratefails. - CLI · MCP · SDK — the three interfaces to the same engine.
- Specifications — the normative contract behind every object and field.