Write it.Run it.Hunt it.Ship it.

The detection workbench for people who live in the terminal · KQL · SPL

Unavailable
$brew install 0xMishee/tap/killy
Documentation soon
Workbench

Five steps, one terminal. Write the query and watch it get flagged, run it, hunt in a notebook, ship it as a pull request.

killy — ~/detections

As code

Killy at your desk and cibo in CI run one engine. What flagged it at your desk is exactly what blocks the pull request.

1

killy

Write and fix in the terminal. Findings as you type.

2

git push

mod+s opens the pull request with diff, backtest and gate.

3

cibo

CI runs the same policies, pinned by .killy.lock.

4

deploy

Only rules that pass the gate reach production.

repo 
detections/
├─ .killy.yaml
├─ .killy.lock
├─ endpoint/
│  ├─ lsass-access.yaml
│  ├─ rundll32-network.yaml
│  └─ wmi-persistence.yaml
└─ splunk/
   └─ lolbin-download.spl
.github/workflows/detections.yml 
on: pull_request
jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4 
      - run: brew install 0xMishee/tap/cibo 
      - run: cibo analyze detections/
pull request
AI, opt-in

AI on a short leash.

179 policies never touch a model. The other 29 ask yes/no questions, and only once you switch them on. Every call is logged before it leaves. Every answer is advisory.

1

Enable


        

      
2
Run

        

        

      
3
See the output

        

    

    
The exact line is written to the local audit log before every call; if it can't be written, nothing is sent. Works with Jev, Laya on your own machine, Claude, OpenAI, Gemini or your company's gateway.

  


  

    
Rules
208 ways to fail a pull request.

      
Each policy asks one question. Pick a class to see what fails and what fixes it.

    
125 static checks over the parsed query54 config checks of the rule's platform settings29 semantic questions for a yes/no model, only when AI is on

    

      
classes

      
policy

    

    
    
Every finding has a stable ID. Look it up, silence it with // killy:ignore and a reason, or add your own policies in a team pack. Covers KQL for Sentinel and Defender XDR; SPL for Splunk is on the way.

  


  

    
Goblin mode
Neovim hands. Jacked in.

      
Goblin mode rips the chrome off: keys only. which-key menus, window chords, Telescope-style search, a floating shell. If your fingers know Neovim, they already know Killy.


    

      

        

          
          
        

        

          
killy — ~/detections

          

          

        

      


      

        
In NeovimIn Killy

        
which-key
mod+k prefix menus
Pause after a chord to see what follows.

        
<C-w> _ |
ctrl+w z zoom
The query, the results or one cell, full screen.

        
gt, tabpages
mod+shift+1…5 areas
Search, Notebooks, Library, Docs, Settings.

        
Telescope
mod+p find anything
fn: wl: det: doc: narrow it down.

        
toggleterm
ctrl+g shell
Your own shell, floating over any screen.

        
:set
: command line
Every setting, with completion.

        
Editor keys are VS Code style in v1; a vim preset is planned.

      

    

    

  


  

    
Data
Keep the data. Burn the identities.

      
Save any result as a local dataset and query it offline. Scrubbing runs before anything is written, so you share the evidence, not the people in it.

    

      
.killy.yaml · privacy
        

        

      

      
5 rows · rundll32-network
        

        

        
:dataset save rundll32-hunt  ✓ 5 rows · 1 part · scrubbed

      

    

    

      
datasets
Parquet on your disk
Datasets live in your data folder, with a 20 GB soft quota per store.

      
offline
A dataset is a source
Open a Search tab on it: same KQL, same policies, run by a local engine.

      
local
Nothing leaves unless you ask
Nothing is downloaded, saved or exported on its own. Results stay in memory until you save or pin them.

      
keys
Secrets in the keyring
API keys come from the keyring, the environment or a command, never a config file.

    

  


  

    
    
KILLY.Terminal appCIBO.Headless · CI

    
Coming soon · Killy and cibo ship with Homebrew

    

      Unavailable
      
$brew install 0xMishee/tap/killy

      
$brew install 0xMishee/tap/cibo

    

    

      
EP · End of Transmission

      
0:00