| name | detection-coverage-review |
| description | Assess detection coverage against the MITRE ATT&CK matrix: which tactics/techniques are covered, partially covered, or blind, weighted by data-source availability and threat relevance. Use to find and prioritize detection gaps for a SOC/program. |
Goal
A coverage map across ATT&CK with honest gap analysis — not a vanity "we cover X
techniques" count, but where you're actually blind and what to build next.
Steps
- Inventory detections — map each existing rule/alert to ATT&CK technique(s)
(use the metadata from
detection-rule-development).
- Inventory data sources — what telemetry is actually collected and onboarded
(you cannot detect what you don't log). Coverage is gated by data, not rule count.
- Rate each technique — None / Partial / Good, factoring rule quality (does it
really detect the technique or just one variant?) and data availability.
- Weight by threat relevance — prioritize techniques used by actors targeting
your sector/environment (pull from
threat-intelligence); don't chase the whole
matrix uniformly.
- Identify gaps & plan — blind spots on relevant, high-impact techniques first;
note whether the fix is a new rule, new data source, or tuning.
Output
An ATT&CK coverage view (tactic × technique with None/Partial/Good), a data-source
gap list, and a prioritized build backlog. Visualize as an ATT&CK-style heatmap
(security-diagramming) and report with security-reporting.
Notes
Coverage is bounded by data sources, not rule count — a missing log source is a
bigger gap than a missing rule. Prioritize by adversary relevance (threat-informed
defense), not raw matrix completeness. Beware "coverage theater": one weak rule
mapped to a technique is not real coverage.
