pwnsycybersecurity + privacy community
SigmaHQ rules, MITRE ATT&CK

Detection Coverage

Pick the log sources you collect. See which MITRE ATT&CK techniques the open SigmaHQ rule library covers for them, and the gaps that other sources can see.

Loading the SigmaHQ snapshot.

How coverage is measured

Each SigmaHQ rule names a log source and carries ATT&CK tags. The page groups rules by source, counts the techniques their tags name, and compares that with the techniques ATT&CK lists for the platforms behind your sources.

  • Platforms per source: CloudTrail, Azure activity and GCP audit map to IaaS; Entra ID and Okta to Identity Provider; Microsoft 365 and Google Workspace to Office Suite and SaaS; GitHub to SaaS; Kubernetes to Containers.
  • A tag is a claim. It records what the author meant the rule to catch. Field names, log settings and parsing decide whether it fires for you, so test rules that matter against your own events.
  • Gaps are ranked by how many rules exist for the same technique in other log sources. A high count means the behaviour is detectable somewhere; the question is whether you collect that source.

Detection coverage FAQ

Where do the rules come from?

From the rules folder of the SigmaHQ repository, the main open library of Sigma detection rules. The page loads a snapshot pinned to one commit, shown under the source picker. Refresh from SigmaHQ fetches the current rules for the sources you picked.

How is coverage counted?

A rule counts toward a technique when it carries that technique's ATT&CK tag, such as attack.t1078.004. A rule on a sub-technique also counts toward its parent. A tag says what a rule is meant to catch. Whether it fires on your data depends on your field names and log settings, so test important rules against real events.

Which techniques count as gaps?

Techniques that ATT&CK lists for the platforms behind your sources, with no rule for your sources. Reconnaissance and Resource Development are left out because they happen before the attacker touches your systems. The list is ranked by how many rules other log sources have for the technique, so the top rows show where a detection is known to be possible.

Why is there no Defense Evasion column?

ATT&CK version 19 renamed tactic TA0005 to Stealth and added Defense Impairment (TA0112) for techniques that disable or tamper with security tools and logging. SigmaHQ rules already use the new tags.

Is anything I select sent anywhere?

No. The page loads rule metadata from pwnsy and, on refresh, rule files from jsDelivr and the commit ID from GitHub. Your source picks stay in the page address so you can share the view.

Saved