MITRE Coverage

This page shows MITRE ATT&CK coverage for content in the common library. Two views are available:

1. Built in rules — correlation rules under /Correlations/ only (our native detections and window rules).
2. Built in rules plus Sigma — the same built in set, plus Sigma rules under /Detections/Sigma/ that we distribute as part of the SIEM content pack.

The matrices below show which ATT&CK techniques are covered and how many rules map to each cell.

Use these views to answer:

• Which tactics are covered
• Which techniques have one or many rules
• Which matrix cells are still uncovered

Covered cells are green. Darker green means more rules map to that technique. Gray cells are not covered in that view.

Built in rules only

This matrix reflects only rules in /Correlations/. These are built in correlation and detection rules shipped with the library (match rules, window rules, and related content), not the separate Sigma pack.

Snapshot as of 27 July 2026. Open full size

Built in rules plus Sigma

This matrix adds Sigma detections from /Detections/Sigma/. Together with built in rules, this is the broader coverage picture for what the SIEM distributes to customers.

Snapshot as of 27 July 2026. Open full size