// Investigation
ATT&CK coverage
Detection coverage mapped onto the MITRE ATT&CK enterprise tactics, in kill chain order. Uncovered tactics stay on screen deliberately: a coverage map that hides its gaps is worse than none.
11of 13 tactics covered19techniques mapped2blind tactics
Reconnaissance
0No armed rule covers this tactic.
Initial Access
1Execution
3Persistence
3Privilege Escalation
1Defense Evasion
2Credential Access
3Discovery
2Lateral Movement
0No armed rule covers this tactic.
Collection
1Command and Control
1Exfiltration
1Impact
1// Uncovered tactics
An adversary operating in these phases would generate telemetry that no armed rule inspects. This is the honest reading of the library, not a scoring artefact.
ReconnaissanceLateral Movement