# Detection content — truth table

> Generated by `scripts/detection_truth_table.py`. `--check` gates this
> file in `validate-detections.yml`, so the numbers below can never quietly
> diverge from what the engine actually runs. **Do not edit by hand.**

A rule is **executable** when it fires in AiSOC today: not quarantined
(`_quarantine/` or `enabled: false`) and its `detection` body is the native
AiSOC condition DSL, a Sigma selection/condition, or a runtime-engine language.
A rule is **non-executable** when quarantined or when its only body is an
untranslated upstream language (SPL / YARA-L / CAR pseudocode) — present for
provenance and coverage-mapping, not firing.

## Headline

| metric | count |
|--------|------:|
| rules on disk (total) | 6983 |
| **executable (fire today)** | **947** |
| non-executable (provenance/coverage only) | 6036 |

## By tier

| tier | on disk | executable |
|------|--------:|-----------:|
| car (imported) | 99 | 0 |
| chronicle (imported) | 877 | 0 |
| community | 1 | 1 |
| native | 869 | 869 |
| sigma (imported) | 3132 | 77 |
| splunk (imported) | 2005 | 0 |

## Why rules are non-executable

| reason | count |
|--------|------:|
| `enabled: false` | 115 |
| under `_quarantine/` (untranslated on import) | 5921 |

## How to read the README claim

The imported corpus is large (6983 rules on disk) and valuable as a
provenance-tracked ATT&CK-mapped library, but the number that matters
operationally is **947 executable rules** — the ones the engine
fires against live telemetry. The README and marketplace must cite the
executable figure when describing detection *coverage*, and may cite the
on-disk figure only when explicitly describing the imported *library*.