Skip to main content
For the complete documentation index, see llms.txt. Markdown versions are available by appending .md to page URLs.
Validated: 2026-08-19. Lookout’s deterministic catalog is behavior- and telemetry-driven. Framework coverage is metadata used to explain and review a rule; it never causes a rule to be enabled merely to fill a coverage matrix.

​
Authoritative baselines

  • MITRE ATT&CK Enterprise v19.2, pinned to the official machine-readable CTI snapshot recorded in FRAMEWORK_SOURCES.
  • NIST Cybersecurity Framework 2.0 Core outcomes.
  • CISA Cross-Sector Cybersecurity Performance Goals v1.0.1.
  • SigmaHQ, Elastic Security detection-rules, Splunk Security Content, and Microsoft Sentinel content at pinned upstream commits.
The executable mapping is in src/detection/framework-mappings.js. Tests require every built-in deterministic analytic to have ATT&CK, NIST CSF, and CISA CPG mappings. They also validate mapping relationship strength, require multi-event rules to map NIST correlation outcome DE.AE-03, and prevent the retired pre-v19 log-impairment identifiers from returning.

​
Results

  • 32 of 32 deterministic analytics have framework metadata.
  • 13 of 13 prioritized behavior families have at least one analytic.
  • All 22 high/critical analytics have ATT&CK metadata, and every critical analytic has at least one direct or correlated relationship. Some high alerts intentionally retain contextual ATT&CK mappings because their severity comes from a high-impact control change, not proof of adversary intent (for example, enabling a new exit route).
  • Six representative analytic families were compared against pinned upstream content: authentication abuse, Linux service change, Linux log tampering, network discovery, defense-control change, and recovery impairment.
  • ATT&CK v19 split defense impairment from the older defense-evasion model. Lookout therefore maps disabled security tooling to T1685, Linux/macOS log clearing to T1685.006, and firewall changes to T1686. CISA CPG v1.0.1 still prints older ATT&CK identifiers for these outcomes; those historical identifiers are not copied into Lookout’s live mapping.

​
Interpretation rules

  • Direct: the normalized observable matches the technique-defining action.
  • Correlated: an ordered causal chain supports the technique.
  • Contextual: useful evidence consistent with a technique, but insufficient to assert that technique by itself.
  • NIST and CISA mappings indicate supported outcomes, not certification or proof of compliance.
  • External rules are semantic references only. Lookout does not copy their expressions, thresholds, or licensed content. Product-specific field names are normalized through Lookout adapters before evaluation.

​
Validation limits and deliberate gaps

This review validates taxonomy, observable semantics, required telemetry, severity gates, and representative peer logic. It is not proof of detection against every implementation of a technique. ATT&CK is descriptive rather than an exhaustive test suite, and vendor rules depend on their own schemas and products. The current catalog deliberately leaves low-specificity activity as correlation evidence. DNS failure bursts, broad resource enumeration, unusual successful access, large transfers, route changes, and public-share changes remain contextual unless stronger graph, sequence, or baseline evidence is present. This avoids converting generic administrative activity into noisy high-confidence incidents. Important remaining coverage gaps are payload/malware inspection, vulnerability-specific exploitation, memory telemetry, kernel/rootkit behavior, email threats, SaaS-specific audit semantics, and encrypted-traffic content. These require additional sensors or service adapters; adding rule names without those observables would create false coverage.

​
Maintenance

At each ATT&CK, NIST, CISA, SigmaHQ, or reviewed vendor-content release:
  1. update the pinned source commit/version and retrieval date;
  2. review revoked, deprecated, renamed, or split ATT&CK techniques;
  3. compare relevant upstream rule logic and false-positive guidance;
  4. rerun synthetic rule tests and safe end-to-end validation; and
  5. record sensor gaps instead of claiming unsupported coverage.