Detection coverage
Detections Tracemill can validate the day you connect. Every test is open source, so you can read exactly what it sends and what it expects.
606
out-of-the-box detections
811
attack test scenarios
241
benign controls that must not fire
217
MITRE ATT&CK techniques
| Data source | Splunk ESCU detections |
|---|---|
| Windows (Security + Sysmon) | 399 |
| AWS CloudTrail + Security Lake | 62 |
| Microsoft 365 | 85 |
| Microsoft Entra ID | 56 |
| Cisco Secure Firewall | 3 |
| Google Cloud Audit Logs | 1 |
| Total | 606 |
All detections
Tests = attack scenarios + benign controls. Missing one of yours? Enroll a custom detection or contribute on GitHub.