Every technique in the Enterprise ATT&CK matrix, shaded by how many of this library's detections — summed across all fourteen catalogues and every platform, not just one — actually map to it. Dashed cells are gaps: zero detections reference that technique today. Sub-techniques roll up into their parent (T1098.001/.002/… all count toward T1098) — hover or focus a cell for the breakdown.
A validation catalogue is not a detection catalogue: each entry below is a test-execution reference for confirming an existing detection actually fires, not a production rule of its own — the exact command to generate one privileged action (RHEL, FortiGate, Cisco SD-WAN, RHEL IdM/IPA, or Windows — see the Platform filter), whether it's safe to run in a lab (SAFE Test), a rollback step, expected platform telemetry, and a one-shot presence-check search. See docs/validations.md for the full rationale.