Detections & the SIEM
The Wazuh SIEM, custom detection rules mapped to ATT&CK, and how coverage is measured.
The blue-team half of every purple-team loop runs on a real SIEM. Ranges that include detection ship an all-in-one Wazuh (indexer, manager, and dashboard) with agents forwarding telemetry from the lab hosts. You reach it from the lab card's SIEM button.
Detections mapped to ATT&CK
Tyrian injects custom manager rules so the techniques the scenarios fire actually surface as alerts, each tied to its ATT&CK technique. On the AD range that includes, among others:
- Kerberoasting, 4769 with RC4 (T1558.003)
- AS-REP roasting, 4768 without pre-auth (T1558.004)
- PsExec service creation, 7045 (T1021.002)
- LSASS access, Sysmon EID 10 (T1003.001)
- Password spraying, repeated 4625 (T1110.003)
- DCSync, 4662 replication rights (T1003.006)
On the container ransomware range, level-12 rules elevate the EDR's mass-encryption and ransom-note events so the dashboard shows real T1486 alerts on detonate.
Measuring coverage
Coverage is the share of exercised techniques your telemetry actually caught. Tyrian infers detection by matching each technique against the alerts observed in the session, then reports it as a Purple-team attack-vs-detection table, every undetected technique is a GAP and your next detection to build.
Give-away detection content
The public ATT&CK library ships a free, MIT-licensed Detection Pack, Sigma and Wazuh rules for every technique the scenarios cover. Use them as a baseline, then run the matching range to prove they fire.
Run it, don't just read it
Launch a real range and close the attack-to-report loop. $5 free credit, no card.