Detection Coverage

Generated: 2026-11-03T16:54:30Z

This page is a curated selection, not the size of the corpus. It picks the highest-scoring rules per threat family from the set the engine loads, so its numbers are smaller than the executable total by design. For the corpus figures — executable, on disk, and why they differ — see the detection truth table.

Candidates are the rules whose ids appear in the compiled ruleset, which is the same authority the truth table uses. It used to be the directory layout, and that stopped being the same thing once the Sigma compiler began translating rules where they sat: rules under _quarantine/ that the engine loads were skipped for their path.

Headline numbers

• Curated detections: 601 (target: ≥ 300)
• Executable rules considered: 2942 (quality floor: 0.55)
• Unique MITRE techniques covered: 122

Coverage by buyer family

Family	Count	Target	Covered
Ransomware	87	≥ 25	✅
Credential Access	100	≥ 25	✅
Lateral Movement	67	≥ 25	✅
Data Exfiltration	100	≥ 25	✅
Cloud	100	≥ 25	✅
Identity	100	≥ 25	✅
Supply Chain	94	≥ 25	✅
Kubernetes / Containers	98	≥ 25	✅

Distribution

By tier

• imported: 98
• native: 503

By severity

• critical: 164
• high: 267
• low: 28
• medium: 142

By category

• application: 106
• cloud: 161
• data-exfil: 69
• endpoint: 156
• identity: 101
• network: 8

How to audit

The curated rule IDs are listed in marketplace/curated.json under each family. Every entry has a path field pointing at the on-disk YAML. Run pnpm marketplace:curate --check in CI to enforce drift; run python3 scripts/curate_detections.py locally to regenerate.