Our library declares evidence for 84 techniques. Our bench can witness 18 of them.

This is a per-technique evidence map, published because a per-technique verdict is only meaningful next to the sensor set that produced it. The same technique reads covered in one estate and unknown in another, and nothing in a coverage percentage tells you which one you are looking at.

Two columns, deliberately

Every row below carries two verdicts, and the distance between them is the point.

Method

Every scenario in the library declares, per stage, a MITRE technique and the data source its detection reads. We took the 186 stages that carry a technique, collapsed them to 84 unique techniques, and classified each one twice.

Column one — what the library declares. A technique whose stages read only network-class sources (network, dns, proxy, ics_protocol) is essential: within this library there is no non-network path to it. A technique with both a network-class and a host-class stage is substitutable. A technique with no network-class stage at all is complementary. This is design intent, recoverable from source, and it is not a measurement.

Column two — what this bench can verify. The bench is one Ubuntu 22.04 host with a Wazuh agent. No Sysmon. No commercial EDR. No Zeek, no Suricata, no NetFlow. No cloud. It therefore collects two of the classes the library uses, and a technique whose evidence never reaches it stays still unknown — not uncovered, and not covered.

What the gap says

The library's most-used evidence class is sysmon, at 68 of 186 stages. This bench runs Linux and has no Sysmon, so the single largest body of declared evidence is one it cannot witness at all. That is why 66 techniques stay unknown, and it is a fact about the bench rather than about the library or about the techniques.

Read the other way: a per-technique verdict is a property of an estate, not of a technique. Two organisations running the same library against the same 84 techniques will produce different maps, and both maps can be honest. Anyone publishing a single universal ratio is publishing a property of their own sensor set without saying so.

Limits, stated here rather than in a footnote

One library, one bench, one point in time. Column one is read from source and is therefore a statement about how the library was written, not about whether the detection works. Column two is bounded by the sensor set above and by nothing else — a richer estate moves rows out of still unknown in both directions. Substitutable in particular cannot be proven from source at all: proving that a host signal satisfies the same detection requirement as a network signal takes a run, and this table does not contain one. We publish the list and the raw data so that any of this can be recomputed or contradicted.

The full list

84 rows. Technique links go to attack.mitre.org. Sigma column shows the first two rule names the library attaches, where it attaches any.

Raw data

Published rather than available on request, so every number above is recomputable:

• detection-evidence-map-84-techniques.json — per technique: data sources, both verdicts, Sigma rule names
• detection-evidence-map-84-techniques.csv — the same as a flat table