Attributions
Updated October 2026TillShield maps its detection rules and checks onto public security catalogues so coverage means the same thing to you as it does to everyone else. These are the catalogues we ship, the exact version, and the notice each one asks for.
Catalogues we ship
| Catalogue | Version | What ships | Licence |
|---|---|---|---|
| MITRE ATT&CK® (Enterprise and Mobile) | 19.2, released 2026-08-05 | Tactic, technique and data-component IDs and names, platforms, retirement status, and which data components each technique is detected from. No descriptions. | ATT&CK Terms of Use |
| OWASP Top 10 | 2025 | Category IDs and names. | CC BY 3.0 |
| OWASP Application Security Verification Standard | 5.0.0 | Chapter, section and requirement IDs and titles. Requirement text is not reproduced. | CC BY-SA 4.0 |
| OWASP Mobile Application Security Verification Standard | 2.1.0 | Group and control IDs and group titles. Control text is not reproduced. | CC BY-SA 4.0 |
| SLSA | 1.2 | Track and level names. | Community Specification License 1.0 |
Each catalogue is pinned to the version above. A newer release reaches TillShield only after we check its licence again and every rule's tags still resolve against it.
Notices
MITRE ATT&CK® (Enterprise and Mobile). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
OWASP Top 10. OWASP Top 10:2025 © OWASP Foundation, CC BY 3.0. Category names are reproduced; the text is not.
OWASP Application Security Verification Standard. OWASP Application Security Verification Standard 5.0.0 © OWASP Foundation, CC BY-SA 4.0. Chapter, section and requirement IDs and titles are reproduced; requirement text is not.
OWASP Mobile Application Security Verification Standard. OWASP MASVS 2.1.0 © OWASP Foundation, CC BY-SA 4.0. Group and control IDs and group titles are reproduced; control text is not.
SLSA. SLSA specification v1.2 © The Linux Foundation, Community Specification License 1.0. Level names are reproduced.
MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. TillShield is not affiliated with or endorsed by MITRE or the OWASP Foundation.
What we do not ship
CIS Benchmarks. Their licence does not allow commercial redistribution, so no CIS text or control list ships with TillShield. You can still tag your own rules with CIS references; we keep the tag as your reference and do not check it.
Sigma. TillTell rules borrow Sigma's YAML shape so they read familiarly. No Sigma rule content ships; every rule in the library was written for Till's own records.
Where you see them
The TillTell coverage map scores your rules against ATT&CK and prints the notice beneath the map. Coverage answers from the API carry the catalogue version and the notice in every response.