Detection engineering, with its evidence
From threat to detection, with every source on the record.
What the sources say about a threat, the published rules that detect it, the techniques nothing covers yet, and a workspace where the missing detection becomes yours.
The catalogue is open to everyone. Intelligence and a workspace come with a free account.
27 of 222techniques have no published rule of their own· 2 of them are watched through a sub-technique
- Published rules per technique
- None of its own
- 1–2
- 3–28
- More than 28
The platform
Three products, one path.
What is out there, what detects it, and where the detection that is missing gets written.
- What Intelligence does
Intelligence
What the sources say about indicators, CVEs and threat actors, and who said it.
Free account Detection Catalogue
Published detection rules, with where each one came from and what it covers.
No account neededWhat Detection Catalogue doesSourceUpstream IDLicenceATT&CKVersion
- What Workspace does
Workspace
Where a gap becomes your detection: write it, review it, share it.
Free account
How this is governed
Properties, not badges.
Security here is a set of architectural guarantees. There is no certification to show you, so what is published is what is enforced.
Read the security page- Explicit trust boundaries
- Public, authenticated, privileged and service operations are subject to differentiated access policies.
- Workspace isolation
- Access to resources is authorized server-side and reinforced by isolation controls in the data layer.
- Controlled publication
- Public interfaces expose only information intended for publication. Private content, drafts and internal data remain subject to access controls.
- Auditable operations
- Operations that change state require explicit authorization and leave audit evidence.
Start with what exists. Write what is missing.
The catalogue needs nothing from you. Intelligence and a workspace come with a free account.