They use ATT&CK as a coverage framework... I think we're looking at a cyberark product for EDR... but we still need to be able to easily generate and fill use cases