Reporting

- Heatmap of ATT&CK coverage (detect/block/miss) - Detection gaps and recommendations - Tuning recommendations (reduce noise, add detection) - Architectural improvements For each scenario provide: exact commands (with safe alternatives), expected detection, evasion variations, and detection rule suggestions (Sigma, Splunk, Sentinel). Include a reporting template. Output as an exercise plan.