Detection as Code

Coverage analytics: 4 capabilities

Coverage analytics is documented to 52 percent across the 14 platforms (documented counts 1, partial 0.5). The capabilities are ATT&CK map, Gap view, Data sources, Log source health. Each row below gives the page that supports a documented or partial cell, with its read date.

Coverage analytics columns only.
PlatformCoverage analyticsScore
ATT&CK mapGap viewData sourcesLog source health
PantherPanther, ATT&CK map: documenteddocumentedPanther, Gap view: documenteddocumentedPanther, Data sources: partialpartialPanther, Log source health: partialpartial3.0 / 4
Elastic SecurityElastic Security, ATT&CK map: documenteddocumentedElastic Security, Gap view: documenteddocumentedElastic Security, Data sources: partialpartialElastic Security, Log source health: partialpartial3.0 / 4
Google Security OperationsGoogle Security Operations, ATT&CK map: documenteddocumentedGoogle Security Operations, Gap view: documenteddocumentedGoogle Security Operations, Data sources: partialpartialGoogle Security Operations, Log source health: partialpartial3.0 / 4
Splunk Enterprise Security (Cisco)Splunk Enterprise Security (Cisco), ATT&CK map: documenteddocumentedSplunk Enterprise Security (Cisco), Gap view: partialpartialSplunk Enterprise Security (Cisco), Data sources: partialpartialSplunk Enterprise Security (Cisco), Log source health: documenteddocumented3.0 / 4
Microsoft SentinelMicrosoft Sentinel, ATT&CK map: documenteddocumentedMicrosoft Sentinel, Gap view: documenteddocumentedMicrosoft Sentinel, Data sources: partialpartialMicrosoft Sentinel, Log source health: partialpartial3.0 / 4
Sigma and pySigmaSigma and pySigma, ATT&CK map: documenteddocumentedSigma and pySigma, Gap view: not documentednot documentedSigma and pySigma, Data sources: not documentednot documentedSigma and pySigma, Log source health: not documentednot documented1.0 / 4
Sekoia.ioSekoia.io, ATT&CK map: documenteddocumentedSekoia.io, Gap view: partialpartialSekoia.io, Data sources: partialpartialSekoia.io, Log source health: partialpartial2.5 / 4
AnvilogicAnvilogic, ATT&CK map: partialpartialAnvilogic, Gap view: partialpartialAnvilogic, Data sources: not documentednot documentedAnvilogic, Log source health: partialpartial1.5 / 4
HuntersHunters, ATT&CK map: documenteddocumentedHunters, Gap view: documenteddocumentedHunters, Data sources: partialpartialHunters, Log source health: partialpartial3.0 / 4
SOC PrimeSOC Prime, ATT&CK map: partialpartialSOC Prime, Gap view: partialpartialSOC Prime, Data sources: partialpartialSOC Prime, Log source health: not documentednot documented1.5 / 4
DetecteamDetecteam, ATT&CK map: partialpartialDetecteam, Gap view: partialpartialDetecteam, Data sources: not documentednot documentedDetecteam, Log source health: not documentednot documented1.0 / 4
Mate SecurityMate Security, ATT&CK map: partialpartialMate Security, Gap view: partialpartialMate Security, Data sources: not documentednot documentedMate Security, Log source health: partialpartial1.5 / 4
CardinalOps (Cribl)no longer ships under this nameCardinalOps (Cribl), ATT&CK map: partialpartialCardinalOps (Cribl), Gap view: partialpartialCardinalOps (Cribl), Data sources: partialpartialCardinalOps (Cribl), Log source health: partialpartial2.0 / 4
SnapAttack (Cisco)no longer ships under this nameSnapAttack (Cisco), ATT&CK map: not documentednot documentedSnapAttack (Cisco), Gap view: not documentednot documentedSnapAttack (Cisco), Data sources: not documentednot documentedSnapAttack (Cisco), Log source health: not documentednot documented0.0 / 4

documenteddocumentedpartialpartialnot documentednot documented

What each platform documents

Documented and partial cells with their notes and sources. A cell that names no feature is listed as not documented, which says only that the public pages read do not name it.

PlatformCells
Panther
  • ATT&CK map: documented ATT&CK map, documented. 'Framework Mapping and MITRE ATT&CK Matrix': map detections to ATT&CK docs.panther.com read 2026-11-03
  • Gap view: documented Gap view, documented. MITRE ATT&CK tab on the Dashboard shows Covered, Partially Covered, Not Relevant per technique docs.panther.com read 2026-11-03
  • Data sources: partial Data sources, partial. ATT&CK matrix coverage states reference onboarded log sources; no separate source coverage view docs.panther.com read 2026-11-03
  • Log source health: partial Log source health, partial. 'Monitoring Log Sources' shows unhealthy sources and drop-off alarms; not linked to the rules that use them docs.panther.com read 2026-11-03
Elastic Security
  • ATT&CK map: documented ATT&CK map, documented. 'MITRE ATT&CK coverage' page; custom rules mapped in Advanced settings; threat field in TOML elastic.co read 2026-11-03
  • Gap view: documented Gap view, documented. 'MITRE ATT&CK coverage' page: 'Identifying coverage gaps' via light or empty cells elastic.co read 2026-11-03
  • Data sources: partial Data sources, partial. 'Data Quality dashboard' checks ECS mapping of indices; not a view of detection coverage per source elastic.co read 2026-11-03
  • Log source health: partial Log source health, partial. Rule execution warning when a rule's index pattern is not found; no per-source health tied to rules elastic.co read 2026-11-03
Google Security Operations
  • ATT&CK map: documented ATT&CK map, documented. 'Monitor threat coverage (MITRE)' maps detections to tactics and techniques docs.cloud.google.com read 2026-11-03
  • Gap view: documented Gap view, documented. MITRE dashboard 'helps you find gaps in your threat coverage' docs.cloud.google.com read 2026-11-03
  • Data sources: partial Data sources, partial. 'Ingestion metrics overview' and dashboards; not a coverage-versus-rules view docs.cloud.google.com read 2026-11-03
  • Log source health: partial Log source health, partial. 'Monitor rule performance' attributes detection delay to late ingestion or parsing; no per-rule source health link docs.cloud.google.com read 2026-11-03
Splunk Enterprise Security (Cisco)
  • ATT&CK map: documented ATT&CK map, documented. research.splunk.com: each detection is mapped to MITRE ATT&CK research.splunk.com read 2026-11-03
  • Gap view: partial Gap view, partial. Detection Studio product page: 'Map coverage and technical gaps' against ATT&CK (product page, not reference docs) splunk.com read 2026-11-03
  • Data sources: partial Data sources, partial. Detection Studio product page: 'Identify data source gaps'; use case library shows sourcetype and data model status splunk.com read 2026-11-03
  • Log source health: documented Log source health, documented. Use case library shows status icons for the sourcetypes and data models each detection search uses help.splunk.com read 2026-11-03
Microsoft Sentinel
  • ATT&CK map: documented ATT&CK map, documented. Analytics rule MITRE ATT&CK field; 'View MITRE ATT&CK coverage' learn.microsoft.com read 2026-11-03
  • Gap view: documented Gap view, documented. MITRE ATT&CK page with recommended coverage ratio of active detections to available templates learn.microsoft.com read 2026-11-03
  • Data sources: partial Data sources, partial. 'Monitor the health of your data connectors'; no coverage-versus-detections view on pages read learn.microsoft.com read 2026-11-03
  • Log source health: partial Log source health, partial. SentinelHealth covers connectors and rules separately; no link between them stated learn.microsoft.com read 2026-11-03
Sigma and pySigma
  • ATT&CK map: documented ATT&CK map, documented. Sigma 'tags' field carries ATT&CK tags per rule raw.githubusercontent.com read 2026-11-03
Not documented: Gap view, Data sources, Log source health.
Sekoia.io
  • ATT&CK map: documented ATT&CK map, documented. 'Security Profile (MITRE ATT&CK)' matrix built from rule tags docs.sekoia.com read 2026-11-03
  • Gap view: partial Gap view, partial. Matrix cells colored by rule count; gaps are inferred from empty cells, no gap report named docs.sekoia.com read 2026-11-03
  • Data sources: partial Data sources, partial. Rules list 'Compatible intake formats'; 'Asset connector health status' (Reveal module) docs.sekoia.com read 2026-11-03
  • Log source health: partial Log source health, partial. Rule cards show compatible intake formats; no source health tied to rules docs.sekoia.com read 2026-11-03
Anvilogic
  • ATT&CK map: partial ATT&CK map, partial. 'Every detection mapped to MITRE ATT&CK tactics and techniques' (product page) anvilogic.com read 2026-11-03
  • Gap view: partial Gap view, partial. 'Maturity Scoring': 'continuously measures your MITRE ATT&CK coverage, highlights gaps, and recommends what to build next' anvilogic.com read 2026-11-03
  • Log source health: partial Log source health, partial. 'Health Insights' appears as a feature label only anvilogic.com read 2026-11-03
Not documented: Data sources.
Hunters
  • ATT&CK map: documented ATT&CK map, documented. 'Threat Coverage' map on MITRE ATT&CK v14; detectors counted per technique docs.hunters.ai read 2026-11-03
  • Gap view: documented Gap view, documented. Threat Coverage map: gray technique means 'currently not covered' docs.hunters.ai read 2026-11-03
  • Data sources: partial Data sources, partial. Detector list shows data sources per detector; gray cells can reflect missing telemetry docs.hunters.ai read 2026-11-03
  • Log source health: partial Log source health, partial. 'About data health' monitors each data flow; not tied to detectors docs.hunters.ai read 2026-11-03
SOC Prime
  • ATT&CK map: partial ATT&CK map, partial. Prime Detect: 'Each match carries severity and ATT&CK technique' (product page) socprime.com read 2026-11-03
  • Gap view: partial Gap view, partial. Threat Detection Marketplace 'SOC Coverage: Track MITRE ATT&CK technique coverage'; 'MITRE ATT&CK Audit' service socprime.com read 2026-11-03
  • Data sources: partial Data sources, partial. 'SOC Coverage' also tracks 'log source coverage' (product page) socprime.com read 2026-11-03
Not documented: Log source health.
Detecteam
  • ATT&CK map: partial ATT&CK map, partial. Built on 'ATT&CK Adversary Tactics & Techniques'; scenarios built from TTPs detecteam.com read 2026-11-03
  • Gap view: partial Gap view, partial. 'Baseline what your detections are seeing and what they do not see' detecteam.com read 2026-11-03
Not documented: Data sources, Log source health.
Mate Security
  • ATT&CK map: partial ATT&CK map, partial. Platform page: 'Detection coverage scales across the MITRE ATT&CK Framework' (claim, no per-rule mapping shown) mate.security read 2026-11-03
  • Gap view: partial Gap view, partial. 'Cut the noise, turn blind spots into detections'; 'Maximal Coverage'; no gap view described mate.security read 2026-11-03
  • Log source health: partial Log source health, partial. Homepage use case 'Security Engineering: Tool & data-source health'; not tied to rules mate.security read 2026-11-03
Not documented: Data sources.
CardinalOps (Cribl)
  • ATT&CK map: partial ATT&CK map, partial. 'maps existing detections to MITRE ATT&CK' (Cribl blog) cribl.io read 2026-11-03
  • Gap view: partial Gap view, partial. 'surfaces coverage gaps, provides recommendations for new rules' cribl.io read 2026-11-03
  • Data sources: partial Data sources, partial. Detection posture analysis 'can point back to missing log sources, events, or fields' cribl.io read 2026-11-03
  • Log source health: partial Log source health, partial. Coverage gaps traced to missing log sources or fields; no ongoing source health feature described cribl.io read 2026-11-03
SnapAttack (Cisco)Not documented: ATT&CK map, Gap view, Data sources, Log source health.

Other groups: Languages, Source control and CI, Testing, Rule health, Library. Back to the full matrix.