Detection Licensing Auditor
See what each rule declares, what conditions attach, and what is unresolved.
The engine reads the YARA and Sigma rules you hold or are evaluating for acquisition, the license each one declares, and the evidence around it. It reports, per rule and per scenario, whether the stated use is permitted subject to conditions, not permitted, or unresolved, and names the line of evidence a reviewer must read. The deliverable is a detection-content licensing diligence report. The engine exists. The service around it is not built.
How it works
- 1
Record the content examined
A bounded capture records the size and hash of each captured rule file, tying the report to the content examined.
- 2
Record the license evidence
License evidence may appear at the repository, the file, or the individual rule. Each verdict names the evidence it rests on, and a reviewer decides what that evidence establishes. Inheritance alone does not establish permission.
- 3
Evaluate each use separately
Internal use, hosted or managed service, redistribution, and modification receive separate verdicts. Permission for one use does not establish permission for another.
- 4
Report the gaps
Unresolved licenses and coverage gaps appear as findings. The report states its YARA and Sigma scope.
What the report covers
- Evaluate internal use, hosted or managed service, redistribution, and modification separately.
- Name the line of evidence behind every verdict. Inheritance alone does not produce a favorable verdict.
- Keep unresolved licenses unresolved. Missing evidence does not produce a pass.
- Recorded hashes establish correspondence with the exact content examined, not legal correctness.
- No model and no network at report time. The same capture reproduces the report byte for byte; the cover hash identifies the exact capture, so a re-capture elsewhere differs only where that hash is printed.
The report brings the verdicts, the license evidence, and the unresolved questions together for review by your team, counsel, or an acquirer. It is also planned as an add-on to AI Badge plans, with intended pricing on the AI Badge page.
Where this stands
Neither product line is generally available yet. Nothing on this site is for sale today.
The Detection Licensing Auditor engine exists. Its service is not built. AI Badge's analyzer reads JavaScript and TypeScript today and has been run against the commit history of 14 public repositories. The pull request check, merge blocking, the organization dashboard, and the features in the intended plans are in development. Support for Go, Rust, Python, and C# is planned.
If you evaluate detection content, or review code changes written with AI assistants, we would like to hear how you work.
The Detection Licensing Auditor's report is an engineering analysis of license text and evidence. It is not legal advice and does not substitute for counsel.