Detectability: measured in the lab vs. predicted from public content

_As of DB build 2026-10-02. Generated by analysis/detectability_check.py._

Predicted is how much public detection content (Sigma, Elastic, Splunk, Sentinel, ATT&CK analytics) maps to the attack. Measured is whether our lab Wazuh fired when we detonated it. They answer different questions, so neither overrides the other; a disagreement is the finding.

3 of 633 attacks have lab runs. Agrees 0, lab lower 1, lab higher 1, no public baseline 1, not yet measured 0.

attack	runs	outcomes	measured	predicted	verdict	next step
`lateral-movement-via-remote-services`	3	detected, partially-detected	medium	high	lab-lower	detection-engineer task: public rules exist but our SIEM caught less
`modbus-dnp3-s7-protocol-abuse`	1	detected	medium	none	lab-higher	contribute upstream: our lab rule covers what public content does not
`insecure-iot-network-services`	3	detected	medium	—	no-prediction	no public-content baseline; the lab value stands alone

Evidence

Insecure IoT network services (insecure-iot-network-services)
measured medium from lab-2026-09-29: lab-measured: runs=1 matched_rules=1 (100311) incidental_alerts=5 outcomes=detected; thresholds >=3 rules=high, 1-2=medium, only-incidental=low, silent=none
Lateral movement via remote services (lateral-movement-via-remote-services)
measured medium from lab-2026-09-30: lab-measured: runs=2 matched_rules=1 (100302) incidental_alerts=6 outcomes=detected,partially-detected; thresholds >=3 rules=high, 1-2=medium, only-incidental=low, silent=none
predicted high from sigma-rules-2026-09-18: distinct detection rules mapped to T1021.001/T1021.002/T1021.003/T1021.004/T1021.005/T1021.006/T1021.007/T1021.008: sigma=81 elastic=78 total=159 -> high (thresholds none=0,low=1-2,medium=3-6,high>=7). Sources counted: sigma,elastic; splunk/sentinel/ATT&CK-analytics not yet counted (recount in build.py as they are added).
Modbus/DNP3/S7 protocol abuse (modbus-dnp3-s7-protocol-abuse)
measured medium from lab-2026-10-02: lab-measured: runs=1 matched_rules=1 (100310) incidental_alerts=5 outcomes=detected; thresholds >=3 rules=high, 1-2=medium, only-incidental=low, silent=none
predicted none from sigma-rules-2026-09-18: distinct detection rules mapped to T1692: sigma=0 elastic=0 total=0 -> none (thresholds none=0,low=1-2,medium=3-6,high>=7). Sources counted: sigma,elastic; splunk/sentinel/ATT&CK-analytics not yet counted (recount in build.py as they are added).