Detections
212 rules kept as code in git: 187 live, 19 in testing, 6 turned off. Nothing goes live without a review, a CI run and a backtest.
ATT&CK coverage
What live detections can see across all 12 tenants. Select a tactic or a technique to filter the rule library.
Rule library
| State | Sev | Rule and log sources | ATT&CK | Tenants |
|---|
These 18 fired or changed most recently. The other 194 rules in the repository are quiet.
Recent changes
detections repository, main branch
| Commit | What changed | Who | Age | Result |
|---|
Gaps being closed
Planned detections for techniques the matrix shows as missing or partial. Select one to find it on the matrix.
| Technique | Planned detection and what it needs | Status |
|---|