rabobank-cdc/DeTTECT

Health v2 · maintenance only

Adoption not part of the score

2341 stars · 351 forks observed · 2026-09-26

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DeTT&CT is a Python CLI tool and framework that helps blue teams score and map data source quality, visibility, detection coverage, and threat actor behaviours against MITRE ATT&CK. It generates ATT&CK Navigator visualisations and works with YAML administration files and a web-based editor.

Use cases

• map detection coverage to MITRE ATT&CK
• score the quality of my log data sources
• visualise visibility coverage across endpoints
• compare threat actor behaviours against my detections
• prioritise blue team detection engineering efforts
• generate ATT&CK Navigator heatmaps for coverage

When to choose

• your blue team uses MITRE ATT&CK and wants structured scoring of visibility and detections
• you need to compare detection coverage against threat actor TTPs
• you want Navigator-compatible visualisations of coverage gaps

When to avoid

• you need an automated detection engine or SIEM - DeTT&CT only maps and scores, it does not detect
• you want a GUI-only tool without working with YAML files
• your organisation does not use the ATT&CK framework

Facets

cli-tool · maturity active

security analytics developer-tools security developer-tools python cli cross-platform mitre-attack blue-team threat-detection attack-navigator yaml cyber-threat-intelligence

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rabobank-cdc/DeTTECT")