10 tactics × 8 data sources
80 detection cells
A detection engineering platform lives or dies by one question: how much of the real attack surface do its rules actually cover, right now, not on the day they were written? This simulator renders an 80-cell tactic × detection-data-source coverage matrix, in the shape of the MITRE ATT&CK framework, as a live 2D heatmap with a per-tactic summary strip and a rolling history chart. Every tick, rule authoring pushes cells from red toward tested-and-tuned green while telemetry drift silently erodes them back down — the same tug-of-war a real SOC's CI/CD pipeline runs against schema changes and log-source outages. An alert-threshold slider layers a precision/recall trade-off on top: push it up to suppress false positives and watch estimated mean-time-to-detect creep back up as real detections get buried under a stricter bar. Hover any cell to inspect it, or toggle the chart between coverage percentages and MTTD/false-positive trends. Live readouts track raw coverage, threshold-adjusted effective coverage, estimated MTTD and estimated daily false positives.