Detections

How to use the Detections page in Guard, including BAS results, gap analysis, and Automatic Findings Validation settings.

Detections in Guard

The Detections page is the central hub for Breach & Attack Simulation (BAS) results in Guard. It is organized across four tabs: Overview, Gap Analysis, Decoys, and Sessions.

Each tab maps to a distinct layer of your security posture. Together they answer three questions: What attacks have we tested? What defenses do we have in place? Where are the gaps?

Overview Tab

The Overview tab is an executive-level dashboard that surfaces the most important metrics and action items from across all validation data.

Security Posture Score

The centerpiece of the Overview tab is the Security Posture Score, a single 0-100 metric displayed as a circular progress indicator. The score is color-coded by rating and computed from three weighted components:

Component

Weight

What It Measures

Attack Coverage

40%

The percentage of ATT&CK techniques that have been tested with meaningful defense outcomes, weighted by real-world threat prevalence (sourced from the Picus Red Report). Techniques observed more frequently in the wild carry more weight. Each test outcome is scored on a tier: Prevented (1.0), Responded (0.9), Detected (0.8), Alerted (0.6), Logged (0.3), Undetected (0.1).

Defense Coverage

35%

The percentage of D3FEND defensive controls that are Deployed or Validated. Controls in a Partial deployment state count as half.

Effective Defense

25%

Of the controls that are deployed, the percentage rated Effective or Highly Effective. Controls rated Partially Effective count as half.

Formula: (Attack Coverage x 0.4) + (Defense Coverage x 0.35) + (Effective Defense x 0.25)

The resulting score maps to a five-tier rating: Critical (0-24), Poor (25-39), Fair (40-59), Good (60-79), Excellent (80-100). If no validation data has been collected yet, the score displays as Not Assessed.

Coverage Breakdown

Beside the score widget, a horizontal bar chart compares ATT&CK Coverage, D3FEND Deployment, and Defense Effectiveness.

Top Security Gaps

A table lists the highest-priority security gaps ranked by criticality (technique, tactic, missing defenses, risk score, priority). Clicking any row navigates to that technique in the Gap Analysis tab.

The Recommendations widget identifies which D3FEND techniques would provide the greatest coverage improvement if deployed. Each recommendation links to the official D3FEND documentation.

MITRE ATT&CK, D3FEND, and EMB3D heatmaps are on Insights → Benchmarks, not on this page.

Gap Analysis Tab

The Gap Analysis tab identifies where ATT&CK technique coverage and D3FEND defensive controls do not align. It uses 334 technique-to-control mappings and surfaces techniques that lack effective defense.

Filters and Export

Filter by tactic, priority, and testing status. Filter state is synchronized with the URL. Export the current filtered view to CSV or JSON.

Coverage Completeness

A donut chart breaks techniques into Fully Covered, Partially Covered, and No Coverage.

Undefended Techniques Table

The main table lists every ATT&CK technique that lacks effective defensive coverage. Clicking a row opens a detail drawer with recommended D3FEND controls and remediation guidance.

Ineffective Controls Table

A collapsible section lists D3FEND controls that are deployed but not performing effectively, with recommended actions to Tune or Replace.

Automatic Findings Validation

Automatic Findings Validation (also referred to as Cato auto-triage) automatically evaluates security findings against your validated controls. Configure it from Settings → AI.

  1. Go to Settings → AI.
  2. Locate the Automatic Findings Validation card.
  3. Select Edit to open the configuration modal.

The modal controls whether validation is enabled, which finding severity levels are eligible, and which capability sources feed the workflow.

How Data Feeds Into Detections

  1. BAS Monitoring Sessions — Guard executes attack simulations and polls connected EDR/SIEM/NDR platforms (Microsoft Defender, CrowdStrike, SentinelOne, ExtraHop, Panther) for matching alerts.
  2. MITRE Framework Reference Data — curated datasets aligned to MITRE ATT&CK v14.1, D3FEND, and EMB3D, with prevalence weights from the Picus Red Report.

All scores, gap analyses, and recommendations are computed from real test outcomes mapped against the MITRE framework landscape.