> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Marketplace

> Browse ContraForce-maintained detection templates by data source and pull them into a repository.

The marketplace is a catalog of detection rule templates maintained by ContraForce. Use it
to stand up coverage for a data source quickly rather than writing every rule yourself.

## Browsing by data source

The catalog is organized **by data source** rather than by rule, because the question
driving it is usually "we just connected Azure Key Vault, what should we be detecting?"

Each data source shows how many templates it carries. Select one to see its templates.

<Frame>
  <img src="https://mintcdn.com/contraforce/HQrSzge5Tt9yuYjk/images/content-management-center/marketplace-sources.png?fit=max&auto=format&n=HQrSzge5Tt9yuYjk&q=85&s=20cd3df3e18fbe05281019e9462c76bd" alt="Marketplace tab showing data source cards such as AWS CloudTrail, Azure Activity and Microsoft Entra ID, each with a template count" width="1590" height="831" data-path="images/content-management-center/marketplace-sources.png" />
</Frame>

For each template you can see its **name**, **severity**, **MITRE ATT\&CK tactics**, and
**version**, and open a **preview** of the full rule content before taking it.

## Pulling a template into a repository

<Steps>
  <Step title="Preview the rule">
    Read the query and the entity mappings. A template is a starting point, not something
    to deploy unread.
  </Step>

  <Step title="Choose a destination repository">
    Select the repository the rule should land in. You need the **Author** permission on it.
  </Step>

  <Step title="Add to repository">
    In an unprotected repository the rule is added immediately. In a protected one it
    arrives as work in progress and needs a change request.
  </Step>
</Steps>

Once pulled, the rule is yours: it is an ordinary rule in your repository, and you can edit
it, version it, fork it, and deploy it like any other.

## Templates and versions

Templates are versioned, and the catalog lists the latest version of each. Pulling takes a
copy at that version.

<Note>
  A pulled rule does not stay linked to the template. A later template version does not flow
  into repositories that already pulled it, and your edits are never overwritten by a catalog
  update. To take a newer template version, pull it again and compare.
</Note>

## Tuning before you deploy

Marketplace templates are written to be broadly correct, not tuned to any one environment.
Before deploying to a customer:

* Run the **test query** against the target workspace and confirm it returns what you expect
* Check the **severity** matches how the customer triages
* Check **entity mappings** resolve against their data
* Consider whether the rule belongs in a shared repository or as a
  [fork](/guides/content-management-center/rules#forks) for this customer

A template that fires constantly in one tenant and never in another is normal. The
marketplace gives you the detection logic; the calibration is yours.