Skip to main content

Test Detail Pages

Clicking any test in the browser opens its detail page with comprehensive metadata.

Page Layout​

A header strip carries severity, stage count, author, platform, threat actor, and test score; the MITRE technique chips sit beneath it. Below that, a file tree on the left drives a viewer on the right.

Test detail — header with severity, stages and test score, the file tree, and the rendered README

The tree groups a test's artifacts into Documentation, Build, Visualization, Defense Guidance, References, and Source Code. Selecting an entry renders it in place:

Test detail page — kill chain diagram with stage progression, file tree, and build artifacts

Source Tab​

View the test's Go source code with syntax highlighting. Copy-to-clipboard available for the entire file.

Source code viewer — Go source with syntax highlighting

Documentation Tab​

Rendered markdown documentation describing the test's purpose, behavior, and expected outcomes.

Detection Rules Tab​

KQL (Kusto Query Language) and YARA rules for detecting the test's activity. Copy individual rules to clipboard for use in your SIEM.

Detection rules — LimaCharlie D&R YAML with syntax highlighting beside the test's file tree

References Tab​

External references and documentation links related to the technique.

Metadata Sidebar​

The sidebar displays:

  • MITRE ATT&CK mapping — Techniques and tactics
  • Severity — Critical, High, Medium, or Low
  • Platforms — Windows, Linux, macOS
  • Author and version history
  • Git modification date
  • Tags for additional categorization

Execution Drawer​

Click the Run button to open the execution drawer, which allows you to:

  1. Select target agent(s)
  2. Choose the target platform and architecture
  3. Build the test binary (if not cached)
  4. Create a task for execution

Build & Download​

The Build button triggers Go cross-compilation for the selected platform. See Building & Signing for details.