{ "rules": [ { "rule_id": "ATH-001", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "2-execution" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-002", "true_positives": 1, "false_positives": 1, "false_negatives": 0, "precision": 0.5, "recall": 1.0, "f1": 0.6667, "detected_stages": [ "2-execution" ], "missed_stages": [], "fp_benign_lookalike": 1, "fp_unexplained": 0 }, { "rule_id": "ATH-003", "true_positives": 2, "false_positives": 1, "false_negatives": 0, "precision": 0.6667, "recall": 1.0, "f1": 0.8, "detected_stages": [ "10-exfiltration", "3-payload-download", "4-command-and-control" ], "missed_stages": [], "fp_benign_lookalike": 1, "fp_unexplained": 0 }, { "rule_id": "ATH-004", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "6-credential-access" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-005", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "7-brute-force" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-006", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "7-brute-force" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-007", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "8-lateral-movement" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-008", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "9-collection" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-009", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "1-initial-access" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-010", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "5-discovery" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-011", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "2-recovery-inhibition" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-012", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "1-defense-impairment" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-013", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-014", "true_positives": 1, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [ "6-credential-access" ], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "ATH-015", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "AWS-001", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "AWS-002", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "AWS-003", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "AWS-004", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "AWS-005", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "AWS-006", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "K8S-001", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 }, { "rule_id": "K8S-002", "true_positives": 0, "false_positives": 0, "false_negatives": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "detected_stages": [], "missed_stages": [], "fp_benign_lookalike": 0, "fp_unexplained": 0 } ], "overall_precision": 0.875, "stage_coverage": 1.0, "covered_stages": [ "1-defense-impairment", "1-initial-access", "10-exfiltration", "2-execution", "2-recovery-inhibition", "3-payload-download", "4-command-and-control", "5-discovery", "6-credential-access", "7-brute-force", "8-lateral-movement", "9-collection" ], "uncovered_stages": [], "untargeted_stages": [], "total_true_positives": 14, "total_false_positives": 2, "total_events": 1118 }