Work through the rule backlog instead of adding to it. Mitigate maps coverage against the techniques that matter to you, finds the gaps, tunes rules that fire too often, and drafts new detections from intelligence, hunts and closed cases.
Agents read and write rules in Sigma, SPL, KQL, EQL, YARA-L, Lucene or SQL. They also work with detection-as-code repos, whether those sit in Azure DevOps, GitHub, GitLab or Bitbucket, opening changes the same way your engineers do. Each rule is drafted, translated or tuned, then tested against historical data in the system that already stores it. Approved changes are committed or deployed, and the test results stay in the record.
A proof of concept with Mitigate is scored on these measures, against your own alerts and your own tools.
| No. | Measure | Definition |
|---|---|---|
| 01 | ATT&CK coverage | ATT&CK techniques you have put in scope that have at least one tested, working detection. |
| 02 | Confirmed gaps | Missing detections, checked against the techniques you care about and the logs they need. |
| 03 | Rules improved | Existing rules tuned and re-tested against past data. |
| 04 | True-positive rate | For each tested rule, the share of its alerts that turned out to be real. |
| 05 | New rules passing | New detections that meet the validation criteria agreed at the start. |
| 06 | Request to production | Median days between a detection request being approved and the rule going live. |
We backtest it on your own data, propose a quieter version and open the pull request for your review.