From Threat Intel to Detection Coverage – Automatically

Security teams don't have a shortage of threat intelligence. They have a shortage of time to turn that intelligence into working detections. Every new campaign, malware family, or APT advisory becomes another item on a backlog of rules someone needs to research, write, test, and deploy – usually while everything else on the queue keeps piling up.

Mars's Detection Recommendations feature closes that gap by doing the first 80% of the work automatically.

How it works

As Mars ingests threat intelligence on active campaigns, it doesn't just file the report away – it automatically generates ready-to-deploy detection rules tied to the specific indicators, techniques, and infrastructure involved. Each recommendation arrives already mapped to MITRE ATT&CK, already scoped to the right data source (CrowdStrike, Wiz, firewall logs, Linux Sysmon, and more), and already labeled with a severity rating.

Each campaign shows up as a grouped card with its recommended rules underneath – rule name, severity, source ("Intel-based"), the sensor or log type it runs against, and the ATT&CK technique IDs it covers. Reviewing and deploying is a single click: Accept Rule pushes it live, Dismiss clears it from the queue.

Backtested before it ever fires

The part that keeps this from turning into alert spam: every recommended rule is validated before you ever see it. Each one ships with a "Mars analysis" panel showing how the rule's exact query would have performed against your own environment over the past 30 days – how many events it would have matched, and whether any of those matches were false positives. A rule that's noisy or irrelevant to your environment shows that plainly before you accept it, instead of after it's already flooding your SIEM. You can even re-run the query yourself against a custom time frame and row limit to sanity-check it further before deploying.

That same discipline applies one level down, at the indicator level. Threat intel reports don't come indicator-clean – a campaign write-up might list dozens of domains, hashes, or IPs, and some of those are simply bad IOCs: infrastructure that's since been repurposed, indicators too generic to be specific to the campaign, or ones known to overlap with legitimate traffic. Mars screens each reported IOC against its own false-positive track record before it's allowed into a rule, so the ones with a history of generating noise are dropped rather than shipped.

Beyond intel – closing coverage gaps

Detection Recommendations isn't limited to reacting to breaking threat intel. A dedicated Coverage gap recommendations section continuously analyzes what's already deployed against your connected log sources and surfaces the rules you're missing – things like AWS CloudTrail logging tampering, Route 53 domain transfer abuse, pass-the-hash lateral movement, and suspicious Microsoft Graph API activity for OAuth and conditional access changes. These are the detections a mature SOC should have regardless of the current headline, and the feature flags exactly which ones are absent from your stack.

For teams practicing detection-as-code, some recommendations even come as an open pull request, ready to merge directly into your rule repository.

Why it matters

Detection engineering backlogs are usually the bottleneck between "we read the advisory" and "we're actually covered." By pre-building the rule, mapping it to ATT&CK, pointing it at the right telemetry source, and backtesting it against 30 days of real activity before it's ever deployed, Mars turns that gap into a one-click decision – one you can trust won't bury your SIEM in noise.