Know exactly what your detections cover, and what to fix first.
DEX is the AI-powered detection coverage layer for your SOC. One place to map your SIEM rules to MITRE ATT&CK, score yourself against the APT groups targeting your sector, and see which gaps to close first.
A coverage report that takes weeks by hand runs in DEX in minutes.
The challenge
You have hundreds of SIEM rules and sensors. Nobody can say what they cover.
Five questions land on every security leader's desk. Answering any of them properly takes weeks of manual cross-referencing. DEX turns each one into an answer.
What do our detections actually cover?
You can count your SIEM rules and list your sensors, but neither tells you which attacker techniques they actually detect.
Every rule mapped to ATT&CK
An LLM reads the rule export, infers the data sources and use case behind each rule, and maps it to techniques and sub-techniques.
Can we detect the APT groups known to target us?
Answering takes an analyst several days of cross-referencing rules against a threat report.
Scored against real adversaries
Coverage is measured against the groups observed in your industry and region, with last-observed dates for each one.
Which rules are duplicated or dead?
Rule libraries grow through migrations and staff changes. Few teams have audited theirs.
The rule library, audited
Duplicates, dead rules and anything that can't be confidently mapped are listed individually, each with the reason.
Are our security tools covering what they claim?
Vendor coverage matrices are self-attested, and there is no way to verify them from inside your SOC.
Vendor claims, verified
SIEM rules and vendor sensors are scored on separate axes rather than averaged, showing which techniques depend entirely on a vendor.
What should the team build next?
Without a coverage baseline, the backlog is driven by the most recent incident.
The work, prioritised
Gaps are sorted by what they cost to close and how much each one unlocks, starting with work that needs no new spend.
All in one platform
Every answer comes out of a single run: auditable, repeatable, and ready for a board review. Re-run any time and export a shareable report.
What you can now do
Six answers you couldn't give last quarter.
Not a feature list. These are the things a security leader can state, and defend, once an assessment has run.
State coverage in technique terms.
A rule count and a sensor inventory say how much you own. Coverage says how much you detect.
Answer an advisory the same day.
Establishing whether you detect a given APT group stops being several days of manual cross-referencing.
See where you rest on one route.
Rules and sensors are scored separately, so single-route techniques surface instead of hiding inside a healthy blended number.
Find coverage you already paid for.
Most gaps close by writing rules against telemetry already flowing in, with no procurement and no new tooling.
Defend the roadmap.
The backlog is ordered by coverage unlocked against effort, so next quarter runs on evidence rather than the last incident.
Show movement over time.
Because assessments repeat, a later run measures progress against the plan the earlier one produced.
What changes
You'll know it worked when the team works differently.
Coverage percentages are the output. These four changes in how the team operates are the point.
01
Planning starts from a baseline
Quarterly detection planning opens with a coverage figure and a ranked gap list, instead of whatever the most recent incident was.
02
Engineers pull from the backlog
The next rule an engineer writes traces to a gap the assessment found, and to the coverage it unlocks when it ships.
03
Coverage questions get answered live
Whether you detect something is settled in the meeting where it's asked, with evidence rather than an estimate.
04
Progress is measured, not asserted
What changed since last quarter has an answer, because the previous assessment's target state is what this one is scored against.
By the numbers
What every assessment gives you
Every Enterprise tactic and sub-technique scored
SIEM rules and vendor sensors measured separately
Re-run whenever you want and measure the movement
Inside DEX
Everything you need, in one console.
Coverage, adversary readiness, gaps and plan. Pick a view.
Coverage
Your whole estate, scored
ATT&CK coverage broken down by tactic, domain and detection route, so strong endpoint coverage can't mask a weak identity picture.
- Coverage by tactic and sub-technique
- Split across Application, Cloud, Email, Endpoint, Identity, Network
- Rule route and sensor route side by side
Navigator
The matrix, filled in
Every technique and sub-technique in the Enterprise matrix, shaded by how well your estate covers it and by which route that coverage arrives.
- Full Enterprise matrix, scored technique by technique
- Filter by tactic, domain or detection route
- Drill into a cell to see the rules behind the score
APT readiness
Scored against the groups that target you
Readiness is measured against adversaries actually observed in your industry and region, each with the date last seen. Not a generic top-ten list.
- Threat model scoped to your sector and country
- Rules, sensor and detection resilience per group
- Answer an advisory in minutes instead of days
Backlog
A ranked plan, not a wish list
Gaps sorted by what they cost to close and how much each one unlocks, starting with work that needs no new spend or tooling.
- Ranked by effort against coverage unlocked
- No-new-spend items surfaced first
- A target-state model later assessments measure against
How the method holds up
A coverage number is only worth what its method is worth.
The hard parts of building this were mostly about refusing to flatter the result. Here's what that means in practice.
Nothing leaves the denominator
Rules that can't be confidently mapped are listed individually with the reason. A percentage over a quietly shrunk denominator is worse than none.
The matrix version is pinned
ATT&CK changes between releases, so the version is fixed and stated on every report. Otherwise this quarter can't be compared with the last.
Routes are never averaged
Rules and sensors are scored on separate axes. Averaging them produces a comfortable number that hides the fragility worth knowing about.
Sensor advice stays capability-first
Recommendations describe the capability a gap needs, with vendor-neutral alternatives alongside any extension of what you already own.
Your rule content stays yours
You run the extraction query in your own console and see exactly what leaves. Your rule content never trains an external model.
In their words
"Manual mapping is prone to error and exaggerated human judgement. DEX's deterministic approach maps rules accurately and gives an accurate coverage assessment, a good starting point toward continuous security posture improvement."
Murugan
Product Manager
