detect Appendices

Appendix B: Score anchors

Framework v0.3.0, updated September 19, 2026.

threat_relevance (T)#

  1. No public reporting in the last 24 months.
  2. Public reporting in the last 24 months, but nothing tying it to your sector.
  3. On MITRE CTID's Top ATT&CK Techniques list, or near the top of a vendor's annual threat report.
  4. Named in reporting about your sector in the last 12 months (an ISAC, a regulator, or a peer).
  5. Seen in your own incidents or red team findings in the last 12 months.

impact (I)#

  1. Reconnaissance, or a low-consequence action on a single host.
  2. One host compromised, and existing controls contain it.
  3. Data access or code execution on a business-critical system.
  4. A step toward the crown jewels: lateral movement or privilege escalation heading for tier-0 identity (domain admin and the systems that control it), OT, or payment systems.
  5. Direct action on tier-0 identity, an OT safety system, or a payment system.

robustness (B)#

  1. Matches a throwaway indicator: a file hash, IP address, domain, or filename the attacker can change at will.
  2. Matches one tool the attacker brings along: its strings, its arguments, the files it drops. A different tool walks past.
  3. Matches how a built-in system program is abused: the arguments or behavior of something that was already on the machine.
  4. Matches something most ways of doing the technique share, such as an API call or a sequence of events.
  5. Matches something every way of doing the technique must produce.

telemetry_readiness (R)#

  1. The log source is not collected at all.
  2. Collected, but the event type or field the rule needs is missing.
  3. Collected, but sampled, truncated, or kept for less than 30 days.
  4. Collected in full and kept 30 days or more, but the fields the rule needs are not parsed out.
  5. Collected and parsed, but not enriched with who the user is or what the asset is.
  6. Collected, parsed, enriched, and covered by the silence alert (DET-0000).

build_effort (E)#

  1. Under 4 hours: adapting a public rule that already comes with test events.
  2. 4 to 8 hours.
  3. 8 to 16 hours.
  4. 16 to 40 hours: needs a simulated attack or new field parsing.
  5. Over 40 hours: needs a new log source brought into the SIEM.

run_cost (C)#

  1. Under 5 analyst minutes a day.
  2. 5 to 15 minutes a day.
  3. 15 minutes to 1 hour a day.
  4. 1 to 3 hours a day.
  5. Over 3 hours a day.