MITRE ATT&CK coverage heatmap

Add evidence and press Build heatmap. The samples show the CSV shape and a Sigma multi-document paste on real technique IDs.

A tagged rule is not a working detection. The heatmap maps where your rule set and coverage lists claim detections so you know where to test first; it never runs a rule against a log. The bundled matrix is ATT&CK Enterprise v20.0 (released 2026-10-13), a snapshot rather than a live registry, and percentages count parent techniques only, with parents showing the best level of their sub-techniques.