Measuring IDS detection coverage against emulated MITRE ATT&CK techniques: experiment artefacts

Artefacts supporting an MSc dissertation that measures how much of a prevalence-anchored MITRE ATT&CK technique set an open-source network IDS stack actually detects. Contents: isolated four-machine laboratory configuration and version pins (including the ET Open ruleset SHA-256); the frozen 29-technique set with selection provenance; the pre-registered detection mapping and Zeek partial conditions; the scored per-technique record; the coverage ledger; an importable ATT&CK Navigator layer; the per-alert ATT&CK-metadata extraction with its reproduction command; and the emulation and manual-procedure records. All scoring rules were fixed in advance; two post-run scoring decisions are recorded transparently in an amendment log.