Public detection library

Detection rules, mapped to ATT&CK

Every rule in the BreachForge library, grouped by the tactic it defends, each mapped to a MITRE ATT&CK technique and written in Sigma, Microsoft Sentinel KQL and Splunk SPL. Copy any of them straight into your own tooling. This is the plain global view. Signed in, the same rules show which techniques your estate actually covers.

96~~Detection rules~~

12~~ATT&CK tactics~~

3~~Query formats~~

67~~Techniques covered~~

Loading the detection library...

See which of these cover your estate

The public library is the same for everyone. Inside BreachForge, these rules map against your own environment, so you see which techniques are covered, which are gaps, and which paths reach a crown jewel without a detection in the way.

Open the console