detection-coverage-review

name	detection-coverage-review
description	Assess detection coverage against the MITRE ATT&CK matrix: which tactics/techniques are covered, partially covered, or blind, weighted by data-source availability and threat relevance. Use to find and prioritize detection gaps for a SOC/program.

Goal

A coverage map across ATT&CK with honest gap analysis — not a vanity "we cover X techniques" count, but where you're actually blind and what to build next.

Steps

1. Inventory detections — map each existing rule/alert to ATT&CK technique(s) (use the metadata from detection-rule-development).
2. Inventory data sources — what telemetry is actually collected and onboarded (you cannot detect what you don't log). Coverage is gated by data, not rule count.
3. Rate each technique — None / Partial / Good, factoring rule quality (does it really detect the technique or just one variant?) and data availability.
4. Weight by threat relevance — prioritize techniques used by actors targeting your sector/environment (pull from threat-intelligence); don't chase the whole matrix uniformly.
5. Identify gaps & plan — blind spots on relevant, high-impact techniques first; note whether the fix is a new rule, new data source, or tuning.

Output

An ATT&CK coverage view (tactic × technique with None/Partial/Good), a data-source gap list, and a prioritized build backlog. Visualize as an ATT&CK-style heatmap (security-diagramming) and report with security-reporting.

Notes

Coverage is bounded by data sources, not rule count — a missing log source is a bigger gap than a missing rule. Prioritize by adversary relevance (threat-informed defense), not raw matrix completeness. Beware "coverage theater": one weak rule mapped to a technique is not real coverage.