Detection vs Scenario Coverage¶

Auto-generated by scripts/detection_vs_scenario_coverage.py. Do not hand-edit -- regenerate with --report.

Summary¶

Top 10 techniques with most detections¶

Detection volume per technique. High count is not always good -- it can mean genuine defence-in-depth, or it can mean the same technique is being repeated across multiple chapters. See the over-covered section below for an honest read.

Top 20 scenarios with the largest detection gap¶

Scenarios are ranked by the count of techniques referenced in the scenario for which no detection in the corpus claims coverage. Uncatalogued scenarios (no extractable techniques) are excluded from this list because there is nothing to gap-check.

Techniques with more than 5 detections (potential over-coverage)¶

These are techniques where the corpus has many detections. Often legitimate (high-priority technique with many real-world variants) but worth a periodic review for duplicates that do not add detection diversity.

Uncatalogued items (no extractable technique IDs)¶

These items did not surface a T#### ATT&CK technique ID in their context window. They are NOT assumed to be invalid -- many are perfectly good detections / scenarios that just do not spell out the technique. They are listed here so a human can decide whether to add the missing tag.

Uncatalogued detections (140)¶

... 90 more uncatalogued detections suppressed for brevity.

Uncatalogued scenarios (0)¶

(none -- every scenario has at least one technique tag)

Methodology (repeated)¶

Methodology disclosure: This report is a technique-ID overlap check, NOT a 'queries actually fire on synthetic log artifacts' check. A detection is considered to 'cover' a scenario if at least one ATT&CK technique ID appears in both the detection's surrounding context (heading, comment, rule metadata) and the scenario's narrative. Real coverage validation requires a log-data-stream simulator plus KQL/SPL/Sigma/YARA parsers; that is a separate, larger task (1.9 in the Revolutionary Plan, full form). Detections without any extractable technique ID in their context are listed as techniques_referenced: [] and counted as uncatalogued rather than fabricated -- the same applies to scenarios with no extractable techniques. Read-only analysis: nothing in docs/ is modified to make the numbers look better.

Reproduce locally:

python scripts/detection_vs_scenario_coverage.py --report
python scripts/detection_vs_scenario_coverage.py --text
python scripts/detection_vs_scenario_coverage.py --scenario SC-009
python scripts/detection_vs_scenario_coverage.py --detection DQ-001
python scripts/detection_vs_scenario_coverage.py --export-json detection-coverage.json