Quickstart

This walkthrough assumes you already have a detection content repository with objects/ content, or that you scaffold one with opentide setup. It shows the core commands fast.

Install and point at your repo

pip install 'opentide==0.1.0'
export OPENTIDE_REPO_ROOT=/path/to/detection-repo

Generate framework artifacts

Schemas, templates, and indexes must exist before validation:

opentide generate

This runs the full pipeline: docs → exports → vocabs → templates → schemas → snippets.

✓ vocabularies loaded
✓ templates written        .opentide/templates/
✓ schemas written          .opentide/schemas/
✓ IDE router               .opentide/schemas/opentide.schema.json
generate: complete

Generation runs first because validation checks objects against these generated schemas — no schemas, nothing to validate against.

Validate content

opentide validate
opentide validate --strict   # warnings also fail (exit 1) — use in CI

On success the process exits 0. For structured detail add --json, which writes one result document to stdout (see Exit codes). If validation fails, see Troubleshooting.

Validate a single platform query language:

opentide validate query --platform sentinel

Inspect the catalogue

opentide info
opentide info rules
opentide --json info --technique T1059 coverage

Dry-run deployment

opentide deploy --platform sentinel --dry-run

Generate object documentation

opentide generate docs

Writes markdown pages for rules, objectives, and threats under the configured docs folder.

New repository from scratch

opentide setup --yes \
  --name "SOC Detections" \
  --org "Example Corp" \
  --platform sentinel \
  --ci github

opentide setup platforms --sentinel --yes
opentide setup mcp --cursor --yes
opentide setup skills --yes --generic

opentide generate
opentide validate