Capability Matrix · Detection-survivability (Component 5)
How many of your detections survive the move?
Losing detection coverage mid-migration is the catastrophic risk for a SOC, the one no cost advantage offsets — so the matrix scores it. Detection-survivability is what fraction of your existing detection corpus survives a move to a candidate target, where survive means executes correctly, not compiles. A green compile matrix is not a ported detection.
This is an illustrative representative-corpus profile grounded in the public lab's SIGMA-EXEC evidence (Tier B, single host, pySigma 1.3.3). The per-client score runs against your actual detection corpus, and is reported with the correlation-subset called out separately so a single-event-heavy sample cannot hide the dangerous tail.
MDR-0029 — the three-band model
The middle band is the one that gets scored worst.
Survives
Expressible on the target, the backend supports the primitive it needs (window, aggregation, join, ordering), and it executes with correct semantics. Full credit.
Silently degrades — scored worst
Compiles and ports but loses a primitive, so it runs but no longer enforces the rule's logic, and nothing announces the loss while the dashboard stays green. Zero credit, scored worse than a clean failure. The measured case: pySigma compiles an event_count rule windowless, dropping the rule's time window from the emitted query. Run over an unbounded history it over-fires (flags 70 where 20 are real); run on a scheduled lookback near the rule's own window it fires correctly. So correctness silently depends on a scheduler setting the query never states, over-firing on a too-coarse lookback or missing a burst split across a boundary. A temporal_ordered rule, separately, runs tumbling-and-unordered and misses boundary-straddling sequences (recall 0.50).
Cannot port (loud)
No equivalent on the target, or needs redesign in the target DSL, and it fails loud — an error at compile or run. Half credit: you lose coverage but you know it and can redesign. A loud refusal is survivable; a silent wrong answer is not.
Scored — computed from the bands
Survivability by target, and the tail the headline hides.
Each target's score is computed from the band each rule type lands in (survives 1.0 · cannot-port 0.4 · silent 0.0), weighted by a representative rule-type mix. Sorted by the correlation-subset score, because that is where survivability actually breaks.
| Target | single-event | event_count | value_count | temporal_ordered | whole | correlation |
|---|---|---|---|---|---|---|
| Elastic ES|QL | ✓ | ✓ | ✓ | loud | 4.6 | 4.3 |
| Elastic Lucene | ✓ | loud | loud | loud | 3.8 | 2.6 |
| OpenSearch PPL | ✓ | SILENT | SILENT | SILENT | 3 | 1 |
| SQL lakehouse (pySigma SQL) | ✓ | SILENT | SILENT | SILENT | 3 | 1 |
The reveal is the gap between the two score columns. OpenSearch PPL scores a comfortable 3 on the whole corpus — most rules are single-event and port fine — while its correlation-subset score is 1, the floor: every correlation rule runs windowless, its time-bound dropped, silently degraded rather than loudly refused. A headline survivability number that averaged over the corpus would call PPL safe; the correlation subset is where the SOC actually loses coverage, so the matrix reports it separately. A loud-refusing target (Elastic Lucene) lands above PPL on both columns (3.8 whole-corpus vs PPL's 3, and2.6 correlation vs1), even though it refuses every correlation rule outright, because a loud refusal keeps the partial credit of a visible loss while a silent wrong answer keeps none.
Survival is a property of the path
A detection can lose fidelity twice.
Survivability reads the whole path, not one cell. A detection's survival also depends on the mapping under it (Component 4): a shipped OCSF mapping that gets the class right while getting the activity classification wrong breaks the detection that keys on activity, so a rule can lose fidelity once at the store/mapping layer and again at the compile target. The streaming-detection layer (Component 7) carries its own detection-content-portability criterion that composes with this one.
This score feeds the augment-vs-replace risk gate (Move #2, MDR-0027): a path that silently degrades a meaningful share of the corpus is ineligible to win the crossover on cost alone. A Full-replace that scores a 1.0 correlation-survivability on its detection target is not cheaper, it is broken — so the cost-cheapest path can be vetoed here before the board read is written.
Honesty boundary
What this illustrative version holds back.
- The bands are grounded in the SIGMA-EXEC matrix but the rule-type mix is a representative illustration, not your corpus. The per-client score runs against your actual detections.
- The whole-corpus score can mask the correlation tail (assumption A-16) — so the correlation-subset score is always reported, and the per-rule verdict (the durable claim) travels with the percentage (the sample-bound one).
- The executed over-fire (precision 0.286, all 50 decoys) is the unbounded-scan extreme, not a rate the SOC will see: under a realistic scheduled lookback the same windowless emit fires at precision 1.0. The transferable claim is the mechanism (the emitted query drops the rule's time window, so correctness rides on an external scheduler lookback that nothing announces), not the number; the temporal_ordered miss (recall 0.50) is likewise corpus-design-dependent. The count-family band re-score behind these numbers (MDR-0034, Accepted 2026-06-24) explicitly holds that band provisional at Tier-B single-corpus until a production rule mix is run.
- Every measured backend is a pySigma plugin (a cross-pySigma-plugin pattern, not yet a non-pySigma / SIEM-native compiler); the count-family window-drop is uniform across the two SQL backends executed, which share one design lineage (generic SQLite and the lineage-derived ClickHouse backend), not two independent confirmations; single host; version-bound to pySigma 1.3.3; the cluster regime is unmeasured.
Decision: MDR-0029. Feeds the decision-path risk gate; the compliance half is compliance / WORM.