Documentation menu
Overview
Getting started
Platform
Partners
Security
Docs / Platform
Detection and ATT&CK
kymeer ships 124 graph detection rules in 14 categories, mapped to 58 ATT&CK technique IDs, with ATT&CK v16.1 bundled and Navigator export.
kymeer ships 124 graph detection rules in 14 categories, mapped to 58 MITRE ATT&CK technique and sub-technique IDs (45 distinct techniques). ATT&CK Enterprise v16.1 is bundled, so mappings are checked, coverage is shown per tactic and you can export it to ATT&CK Navigator.
What rules are included?
| Category | Rules |
|---|---|
| Credential access | 22 |
| Cloud and SaaS | 17 |
| Defence evasion | 15 |
| Impact and ransomware | 12 |
| Command and control | 11 |
| Authentication and identity | 10 |
| Persistence | 9 |
| Endpoint process | 7 |
| Exfiltration | 7 |
| Discovery | 6 |
| Lateral movement | 3 |
| Privilege escalation | 3 |
| Data access and insider | 1 |
| Email and phishing | 1 |
Are the rules on by default?
Yes. Bundled graph rules are active for every tenant unless your team switches a rule off. Each change is per tenant and is written to the audit log.
How do graph rules work?
A graph rule is a predicate over the relationships between users, hosts, services and destinations. The engine provides predicates for:
- first-time relationships, fan-out and fan-in
- geo-hops and implausible travel speed between locations
- attribute matches on entities and on relationships
- sequences, thresholds and absences
- rarity, for one entity and against its peers
- volume spikes, ratio spikes and periodic behaviour
- new entities and sudden changes in connectivity
- paths between entities and reach to a known indicator
What does the event rule engine support?
Conditions, Sigma-style matcher trees, correlation, thresholds with count, distinct-count and sum aggregations, sequences and YARA scanning with size and time limits. Rules are declarative: they carry no scripts or executable code. kymeer does not bundle a Sigma rule library.
How is ATT&CK coverage shown?
- Technique IDs are checked against the bundled matrix when a rule is saved; unknown IDs are rejected.
- The coverage view counts the rules in effect for your tenant, per tactic and overall.
- Coverage downloads as an ATT&CK Navigator layer file.
Who adds or changes rules?
The rule catalogue is managed by the platform. Partners can request a new detection through a review queue. Proposed rules, including AI drafts, are backtested on recent events and stay inactive until a person approves them.