pwnsycybersecurity + privacy community
SigmaHQ rules, MITRE ATT&CK

Detection Coverage

Pick your log sources. See which ATT&CK techniques SigmaHQ rules cover.

Loading the rule snapshot

ATT&CK heatmap
No rule12 to 45 to 910+

Columns are ATT&CK tactics, cells are techniques. Colour is the number of SigmaHQ rules tagged with the technique for your sources: dashed red has none, darker green has more. Click a cell for its rules; click empty space to clear. SigmaHQ snapshot, MITRE ATT&CK Enterprise.

Log sources you collect

Loading the SigmaHQ snapshot.

Technique detail, gaps and rules

How coverage is measured

Each SigmaHQ rule names a log source and carries ATT&CK tags. The page groups rules by source, counts the techniques their tags name, and compares that with the techniques ATT&CK lists for the platforms behind your sources.

  • Platforms per source: CloudTrail, Azure activity and GCP audit map to IaaS; Entra ID and Okta to Identity Provider; Microsoft 365 and Google Workspace to Office Suite and SaaS; GitHub to SaaS; Kubernetes to Containers.
  • A tag is a claim. It records what the author meant the rule to catch. Field names, log settings and parsing decide whether it fires for you, so test rules that matter against your own events.
  • Gaps are ranked by how many rules exist for the same technique in other log sources. A high count means the behaviour is detectable somewhere; the question is whether you collect that source.

How it compares

The Navigator layer is validated against MITRE's layer format 4.5 and the pinned ATT&CK data.

CheckResultNote
Layer format 4.5 fields and types0 errorsChecked on an exported layer
Technique IDs in ATT&CK v19.2All SigmaHQ tags resolveSnapshot 8a48134
Sub-techniques visible on importYesAnnotated sub-techniques open
Featurepwnsy coveragesigma-cli analyze attackDeTT&CT 2.2
Runs in the browserYesNoEditor only
Coverage of SigmaHQ rules by log sourceYesYour rule setYour admin files
Gaps rankedYesNoScoring
Navigator layerFormat 4.5Format 4.4Yes

Known limits

  • Coverage counts rule tags. A tag says what a rule aims at, and the rule still has to fire on your data.
  • Live refresh reads SigmaHQ master, which may carry technique IDs newer or older than the pinned ATT&CK version.

Measured 2026-11-06 with Node scripts that call this page's engine. SigmaHQ commit 8a48134 (2026-10-06, 3,791 rule files). pySigma backend tests read as text: splunk 3.0.0, kusto 1.0.1, elasticsearch 2.1.1, sqlite 2.1.1. Other tools from their own docs on the same date.

Detection coverage FAQ

Where do the rules come from?

From the rules folder of the SigmaHQ repository, the main open library of Sigma detection rules. The page loads a snapshot pinned to one commit, shown under the source picker. Refresh from SigmaHQ fetches the current rules for the sources you picked.

How is coverage counted?

A rule counts toward a technique when it carries that technique's ATT&CK tag, such as attack.t1078.004. A rule on a sub-technique also counts toward its parent. A tag says what a rule is meant to catch. Whether it fires on your data depends on your field names and log settings, so test important rules against real events.

Which techniques count as gaps?

Techniques that ATT&CK lists for the platforms behind your sources, with no rule for your sources. Reconnaissance and Resource Development are left out because they happen before the attacker touches your systems. The list is ranked by how many rules other log sources have for the technique, so the top rows show where a detection is known to be possible.

Why is there no Defense Evasion column?

ATT&CK version 19 renamed tactic TA0005 to Stealth and added Defense Impairment (TA0112) for techniques that disable or tamper with security tools and logging. SigmaHQ rules already use the new tags.

Is anything I select sent anywhere?

No. The page loads rule metadata from pwnsy and, on refresh, rule files from jsDelivr and the commit ID from GitHub. Your source picks stay in the page address so you can share the view.

Saved