Usage

Install opentide, learn the object model, and run detection-as-code — a guided path for detection engineers, agents, and integrators.

opentide is a versioned toolchain for building, validating, deploying, and documenting detection content as code across enterprise security platforms. This section takes you from "what is it?" to a working, CI-gated detection repository.

New here? Read Why opentide and How opentide works first — they give you the mental model that every other page assumes.

Start with the concepts

Detection content in opentide is a small graph of typed objects. Understanding that graph before you touch the CLI saves hours.

How opentide works

The full lifecycle: author → generate → validate → deploy → document.

Object model

Threats, objectives, and rules — and how they chain together.

Platforms

Which SIEM/EDR platforms deploy and which support query validation.

0.18.0 release

Current PyPI release — pin opentide==0.18.0. Generation in under a second.

Pick your path

opentide serves several audiences. Follow the path that matches you.

You are…	Start here	Then
New to opentide, greenfield repo	Installation → Repository setup	Tutorial → Detection-as-code
Checking what shipped	Releases	0.18.0 on PyPI
Evaluating the project	Why opentide → How it works	Object model
Migrating from CoreTide	Migration guide	Configuration
Wiring up an AI agent	Agentic setup	MCP reference
Embedding opentide in Python	SDK	SDK registry

The recommended read order

If you read one thing after another, read them in this order:

flowchart LR
  why["Why opentide"] --> how["How it works"]
  how --> model["Object model"]
  model --> install["Install + setup"]
  install --> tutorial["Tutorial"]
  tutorial --> daily["Detection-as-code"]
  daily --> ci["CI/CD"]
  ci --> agents["Agents (optional)"]

Everyday reference

Configuration — credentials, enabling platforms, statuses and strategies, promotion.
Troubleshooting — what to do when validate or generate fails.
CLI · MCP · SDK — the three interfaces to the same engine.
Specifications — the normative contract behind every object and field.