Platforms
Seven deployment platforms and five query validators — capability matrix and CLI identifiers.
OpenTide integrates with seven detection platforms through built-in adapters registered at import time (opentide.platforms entry points). All ship in the base PyPI package.
Capability matrix
| Platform | CLI --platform | Deploy | Query validate | Query language |
|---|---|---|---|---|
| Microsoft Sentinel | sentinel | yes | yes | KQL |
| Defender for Endpoint | defender_for_endpoint | yes | yes | KQL |
| Splunk Enterprise Security | splunk | yes | yes | SPL |
| SentinelOne | sentinel_one | yes | yes | S1QL |
| Carbon Black Cloud | carbon_black_cloud | yes | yes | Lucene |
| CrowdStrike Falcon | crowdstrike | yes | no | — |
| HarfangLab | harfanglab | yes | no | — |
CLI --platform uses registry keys (defender_for_endpoint, carbon_black_cloud, sentinel_one). These are runtime identifiers — not pip install extras.
Normative capability flags: Platforms spec.
Inspecting capabilities at runtime
opentide info
opentide --json info --platform sentinelMCP resource: opentide://platforms
from opentide import OpenTide
OpenTide.initialise()
for name, plat in OpenTide.Platforms.items():
print(name, plat.enabled, plat.can_deploy, plat.can_validate)Query validation policy
Only platforms with can_validate=True run syntax validation. For CrowdStrike and HarfangLab, CLI and MCP return supported: false — never fake validation.
opentide validate query --platform crowdstrike # reports unsupportedPlatform configuration
Per-platform settings live under .opentide/configurations/platforms/. Enable platforms with opentide setup platforms or the parent opentide setup --platform flags; the registry loads deployers and validators for enabled systems only.
Live deploy dependencies
Validate, generate, and dry-run deploy work with pip install opentide alone. Live API deploy to Splunk or Carbon Black may require additional vendor SDKs — see Installation.
SDK access
Deploy and validate programmatically via OpenTide.Platforms — see SDK platforms.