Detection Coverage

Generated: 2026-07-13T06:40:32Z

Headline numbers

• Curated v1.0 detections: 417 (target: ≥ 300)
• Total rules considered: 1062 (quality floor: 0.55)
• Unique MITRE techniques covered: 117

Coverage by buyer family

Family	Count	Target	Covered
Ransomware	49	≥ 25	✅
Credential Access	85	≥ 25	✅
Lateral Movement	33	≥ 25	✅
Data Exfiltration	41	≥ 25	✅
Cloud	100	≥ 25	✅
Identity	100	≥ 25	✅
Supply Chain	36	≥ 25	✅
Kubernetes / Containers	73	≥ 25	✅

Distribution

By tier

• imported: 42
• native: 375

By severity

• critical: 99
• high: 208
• low: 6
• medium: 104

By category

• _migrated: 1
• application: 33
• cloud: 164
• data-exfil: 20
• endpoint: 117
• identity: 70
• network: 12

How to audit

The curated rule IDs are listed in marketplace/curated.json under each family. Every entry has a path field pointing at the on-disk YAML. Run pnpm marketplace:curate --check in CI to enforce drift; run python3 scripts/curate_detections.py locally to regenerate.