DeTT&CT coverage

dettect editor → matrix coverage

Assess detection and telemetry coverage with DeTT&CT, generating the ATT&CK matrix from rule data and sources.

Use it when you want coverage based on real data: DeTT&CT (Detection Techniques & Tactics) analyzes detection rules (Sigma, SIEM ones) and telemetry sources (available logs) and generates the ATT&CK matrix with coverage — which techniques are detected and with which sources. It's the tool for honest coverage: the Navigator layer generated from data, not from opinions. In purple teaming and detection engineering, DeTT&CT is the coverage measurement: repo rules analyzed and the resulting matrix — detection and telemetry gaps.

Don't use it as a complete measure: DeTT&CT analyzes what you feed it — declared rules and sources; detections without rules (EDR, behavior) and undeclared telemetry won't appear. Analysis quality depends on data structure (rule formats, mapping): prepare them beforehand. And watch out: generated coverage is rule-declared — real validation (atomics) confirms if the rule works; DeTT&CT gives the map, purple team tests it. The generated layer exports to Navigator for presentation.