Detection Surface
Detection Coverage — 210 detection rules + 10 IR playbooks across 10 MITRE tactics
Each detection is repo-counted, mapped to MITRE ATT&CK technique IDs, and routed into SignalFoundry’s triage and evidence pipeline.
103
Sigma
28
Wazuh
79
Splunk (lab)
10
IR Playbooks
MITRE ATT&CK Coverage
Detection density by tactic
Sigma rule distribution across ATT&CK tactics (103 rules shown below). Wazuh, Splunk, and IR playbooks add cross-platform depth not reflected in this chart. Based on actual repo file count.
MITRE ATT&CK Tactic Coverage
Source: content/detection-rules/sigma/ · 103 YAML files across tactic folders · Bar color: red = highest density, green = above average, blue = baseline
Pipeline Integration
Detection Fires
→
Wazuh Alert
→
SignalFoundry Ingest
→
Policy Triage
→
Redaction
→
Evidence Pack
→
Escalation
→
Proof & Evidence ↗
324,074 cases triaged, ~88% auto-closed, 8,574 escalated with evidence. Verify totals →
High-Signal Detections
Critical-severity rules
DCSync Attack Detection
LSASS Memory Dump via Comsvcs.dll
NTDS.dit Credential Extraction
AMSI Bypass Attempt
Masquerading as Windows Process
Ransomware File Encryption
Potential Rootkit Behavior
Firmware Corruption Attempt
Verification
Reproduce these counts
Source of Truth
PROOF_PACK/VERIFIED_COUNTS.mdVerification Command
pwsh -NoProfile -File .\scripts\verify\verify-counts.ps1Last Verified
04-07-2026