Drift ·
How much of a Sigma pack survives when you never read the content?
We assumed 45 percent. Measured, it was 11.
Detection content is written on the assumption that the detector can read everything. Sigma rules reference command lines, file paths, registry values, process arguments. If your architecture is built the other way — metadata only, content never stored — the honest question is what fraction of that body of work you can still run.
We had been answering 45 percent. That number came from reading rule shapes and reasoning about them, not from executing anything. Nobody had asked us to prove it, which is exactly the condition under which numbers drift.
So we built the measurement: load a pack into the engine, attempt evaluation of every rule against the fields the sensor actually produces, report what fires and what cannot. The answer was 11 percent.
That is a worse number and a more useful one. It also turned out to be improvable, because several of the failures were ours rather than structural. Path-referencing rules could not evaluate against hash-only telemetry until we taught the compiler to hash paths rather than compare them. Per-user rules could not fire because home directories were not being collapsed to a canonical form. Every Windows path rule was silently failing on case. None of those are content problems — they are engineering problems that were hiding behind a number nobody had checked.
Where the gap is genuinely structural, we import the rules we can run and decline the rest out loud, in the library, rather than shipping them as coverage.
The rule we keep for ourselves: no number appears in a deck, a page, or a pitch unless it sits in one table with a command that reproduces it. If you cannot reproduce it, do not publish it. An unmeasured claim is not a conservative estimate. It is a number you happen to like.