DeTT&CT
Blue team tool that scores log source visibility and detection coverage into ATT&CK Navigator layers.
Technical Architecture & Overview
DeTT&CT, from Rabobank CDC, helps blue teams score the quality of their log sources, map visibility and detection coverage, and compare adversary behavior against both. Output loads into ATT&CK Navigator as layers, making coverage gaps visible and defensible. The toolchain is Python-based and pairs with Hayabusa output for event log analysis.
Targeted Technical Use Cases
Building a data-driven picture of which ATT&CK techniques your logging and detections actually cover.
Evaluation & Trade-offs
Core Strengths
- +Turns logging gaps into measurable, visual results.
- +Pairs well with Sigma pipelines and Hayabusa.
- +Objective scoring framework for prioritization.
Trade-Offs & Limitations
- -Requires disciplined YAML upkeep as the estate changes.
- -CLI-first workflow is less approachable than web tools.
Defensive Security Application
Finding and closing visibility and detection gaps against ATT&CK techniques.
Frequently Asked Questions
What is DeTT&CT?→
DeTT&CT, from Rabobank CDC, helps blue teams score the quality of their log sources, map visibility and detection coverage, and compare adversary behavior against both. Output loads into ATT&CK Navigator as layers, making coverage gaps visible and defensible. The toolchain is Python-based and pairs with Hayabusa output for event log analysis.
What is DeTT&CT used for?→
Building a data-driven picture of which ATT&CK techniques your logging and detections actually cover.
What are the strengths of DeTT&CT?→
- +Turns logging gaps into measurable, visual results.
- +Pairs well with Sigma pipelines and Hayabusa.
- +Objective scoring framework for prioritization.
What are the limitations of DeTT&CT?→
- +Requires disciplined YAML upkeep as the estate changes.
- +CLI-first workflow is less approachable than web tools.
How is DeTT&CT used defensively?→
Finding and closing visibility and detection gaps against ATT&CK techniques.