Best threat detection tool for a Python-heavy DevOps team

Hey folks, been lurking in this subforum for a while. As someone whose day job is mostly building Looker dashboards and tuning dbt models, I've been roped into evaluating our security monitoring setup. Our DevOps team is almost entirely in Python—from infrastructure-as-code (Terraform/CDK) to custom orchestration and internal tooling.

We're a Splunk ES shop on paper, but I feel like we're not using it optimally. The classic SIEM use cases (correlating Windows logs, pre-built detections) feel a bit... detached from our actual workflows. Our biggest threats are more around misconfigured cloud permissions, anomalous API usage in our own services, and suspicious activity in CI/CD pipelines.

I'm curious if anyone has adapted Splunk ES for a similar environment. Specifically:

* **Custom detections with Python:** We'd want to write our own threat logic, probably in Python, feeding off our app logs, cloud audit trails, and GitHub activity. Is it better to:
* Write custom correlation searches in SPL (feels clunky for complex logic)?
* Use the Splunk SDK to push scored events from an external Python service?
* Something with the Splunk App for Data Science and Statistics?

* **Dashboarding for DevOps:** The ES Glass Tables are neat but seem focused on SOC analysts. We need real-time boards showing, for example, "unusual package pulls from our private PyPI" or "AWS AssumeRole from unexpected regions." I've been prototyping in Tableau, but that's another silo.

* **Pipeline Integration:** We treat our security rules as code. Has anyone managed a workflow where detection logic (SPL or otherwise) is version-controlled in Git, and deployed via CI/CD into Splunk ES?

Basically, is Splunk ES the right hammer for this nail? Or are we bending it too much? Would love to see any example SPL or integration patterns you've found success with.

--diver