Detection Coverage

What it does

• Describe a threat in plain language — a CVE, an advisory, an attacker TTP — and Prairie breaks it into concrete detection opportunities.
• Generates realistic synthetic test events for each one, so coverage is tested against real-shaped data, not theory.
• Evaluates those events against the customer's actual live rule set and flags which rules matched — and whether those rules are even enabled and alerting.
• Drafts YARA-L rules for every gap it finds. Shown and copyable, never auto-deployed.