> ## Documentation Index
> Fetch the complete documentation index at: https://devlookout.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Detection framework cross-reference

> Interpret and maintain Lookout mappings to ATT&CK, NIST CSF, CISA CPG, and Sigma.

> For the complete documentation index, see [llms.txt](https://devlookout.com/llms.txt). Markdown versions are available by appending `.md` to page URLs.

Validated: 2026-08-19.

Lookout's deterministic catalog is behavior- and telemetry-driven. Framework
coverage is metadata used to explain and review a rule; it never causes a rule
to be enabled merely to fill a coverage matrix.

## Authoritative baselines

* MITRE ATT\&CK Enterprise v19.2, pinned to the official machine-readable CTI
  snapshot recorded in `FRAMEWORK_SOURCES`.
* NIST Cybersecurity Framework 2.0 Core outcomes.
* CISA Cross-Sector Cybersecurity Performance Goals v1.0.1.
* SigmaHQ, Elastic Security detection-rules, Splunk Security Content, and
  Microsoft Sentinel content at pinned upstream commits.

The executable mapping is in `src/detection/framework-mappings.js`. Tests
require every built-in deterministic analytic to have ATT\&CK, NIST CSF, and
CISA CPG mappings. They also validate mapping relationship strength, require
multi-event rules to map NIST correlation outcome `DE.AE-03`, and prevent the
retired pre-v19 log-impairment identifiers from returning.

## Results

* 32 of 32 deterministic analytics have framework metadata.
* 13 of 13 prioritized behavior families have at least one analytic.
* All 22 high/critical analytics have ATT\&CK metadata, and every critical
  analytic has at least one direct or correlated relationship. Some high
  alerts intentionally retain contextual ATT\&CK mappings because their
  severity comes from a high-impact control change, not proof of adversary
  intent (for example, enabling a new exit route).
* Six representative analytic families were compared against pinned upstream
  content: authentication abuse, Linux service change, Linux log tampering,
  network discovery, defense-control change, and recovery impairment.
* ATT\&CK v19 split defense impairment from the older defense-evasion model.
  Lookout therefore maps disabled security tooling to `T1685`, Linux/macOS log
  clearing to `T1685.006`, and firewall changes to `T1686`. CISA CPG v1.0.1
  still prints older ATT\&CK identifiers for these outcomes; those historical
  identifiers are not copied into Lookout's live mapping.

## Interpretation rules

* **Direct**: the normalized observable matches the technique-defining action.
* **Correlated**: an ordered causal chain supports the technique.
* **Contextual**: useful evidence consistent with a technique, but insufficient
  to assert that technique by itself.
* NIST and CISA mappings indicate supported outcomes, not certification or
  proof of compliance.
* External rules are semantic references only. Lookout does not copy their
  expressions, thresholds, or licensed content. Product-specific field names
  are normalized through Lookout adapters before evaluation.

## Validation limits and deliberate gaps

This review validates taxonomy, observable semantics, required telemetry,
severity gates, and representative peer logic. It is not proof of detection
against every implementation of a technique. ATT\&CK is descriptive rather
than an exhaustive test suite, and vendor rules depend on their own schemas and
products.

The current catalog deliberately leaves low-specificity activity as
correlation evidence. DNS failure bursts, broad resource enumeration, unusual
successful access, large transfers, route changes, and public-share changes
remain contextual unless stronger graph, sequence, or baseline evidence is
present. This avoids converting generic administrative activity into noisy
high-confidence incidents.

Important remaining coverage gaps are payload/malware inspection,
vulnerability-specific exploitation, memory telemetry, kernel/rootkit
behavior, email threats, SaaS-specific audit semantics, and encrypted-traffic
content. These require additional sensors or service adapters; adding rule
names without those observables would create false coverage.

## Maintenance

At each ATT\&CK, NIST, CISA, SigmaHQ, or reviewed vendor-content release:

1. update the pinned source commit/version and retrieval date;
2. review revoked, deprecated, renamed, or split ATT\&CK techniques;
3. compare relevant upstream rule logic and false-positive guidance;
4. rerun synthetic rule tests and safe end-to-end validation; and
5. record sensor gaps instead of claiming unsupported coverage.