Coverage is a chart, not a claim.
Every number on this page is counted from the Irate detection manifest and hunt pack. Detection content is curated from vendor, community and in-house sources.
2,145
library entries
1,438
correlation rules
707
saved searches
1,413
entries mapped to ATT&CK
| Defense EvasionTA0005 | 298 | |
|---|---|---|
| Initial AccessTA0001 | 282 | |
| PersistenceTA0003 | 258 | |
| Credential AccessTA0006 | 162 | |
| Privilege EscalationTA0004 | 148 | |
| ImpactTA0040 | 143 | |
| ExecutionTA0002 | 102 | |
| DiscoveryTA0007 | 88 | |
| Command and ControlTA0011 | 84 | |
| CollectionTA0009 | 83 | |
| Lateral MovementTA0008 | 78 | |
| ExfiltrationTA0010 | 50 | |
| Resource DevelopmentTA0042 | 7 | |
| ReconnaissanceTA0043 | 5 |
A detection mapped to two tactics is counted under both.
| Microsoft | 319 | |
|---|---|---|
| AWS | 271 | |
| CrowdStrike | 182 | |
| Okta | 115 | |
| VMware | 93 | |
| 78 | ||
| Veeam | 44 | |
| Cisco | 42 | |
| Corelight | 42 | |
| Fortinet | 40 | |
| Cloudflare | 29 | |
| Zscaler | 23 | |
| Palo Alto Networks | 19 | |
| Akamai | 16 | |
| 1Password | 14 | |
| F5 | 12 | |
| Gigamon | 12 | |
| Proofpoint | 11 | |
| Netskope | 10 | |
| Mimecast | 9 |
Plus 707 operational saved searches, 16 further technologies with fewer than 9 entries each, and a handful of locally authored rules.
Hunt pack
13 hunts across six tactics.
Adapted from the open-source Query-Hub community library (MIT licence) and tuned for real environments. Attribution kept per hunt.
TacticHuntTechniques
Initial AccessOutlook link-clickT1566
Initial AccessImpossible travelT1078
ExecutionClickFix run-dialogT1204 · T1189 · T1059.003
ExecutionEncoded PowerShell downloadT1059.001 · T1027
ExecutionLOLBin proxy executionT1218.*
PersistenceSuspicious scheduled taskT1053.005
PersistenceDLL side-loadingT1574.001
Credential AccessCredential dumping / DCSyncT1003 · T1003.006
Command and ControlBehavioral beaconingT1071 · T1571 · T1041 · T1090.004
Command and ControlTor exit nodesT1090.003
ExfiltrationRemovable mediaT1052
ExfiltrationCloud storageT1567.002
ExfiltrationShadow SaaST1526
See it on your alerts
Want this on your data?
We will map your current detections against the same view and show you where the gaps are.