implementing-mitre-attack-coverage-mapping

name	implementing-mitre-attack-coverage-mapping
description	Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize rule development, and measure SOC detection maturity against adversary techniques. Use when implementing mitre att&ck coverage mapping to identify detection gaps, prioritize.
domain	cybersecurity
subdomain	soc-operations
tags	["mitre-attack","detection-coverage","gap-analysis","attack-navigator","soc","detection-engineering"]
version	1.0
author	oyi77
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
d3fend_techniques	["Token Binding","Restore Access","Application Protocol Command Analysis","Password Authentication","Reissue Credential"]
nist_csf	["DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06"]

Implementing MITRE ATT&CK Coverage Mapping

Overview

MITRE ATT&CK coverage mapping gives SOC teams a structured, adversary-centric lens to evaluate detection capabilities. Enterprise SIEMs on average have detection coverage for only 21% of ATT&CK techniques (2025 CardinalOps report), with 13% of existing rules being non-functional due to misconfigured data sources. Systematic coverage mapping identifies gaps, prioritizes rule development, and tracks detection maturity over time. ATT&CK v18.1 (December 2025) is the latest version.

When to Use

Trigger phrases:

• "implementing mitre attack coverage mapping"

• "Implement MITRE ATT&CK coverage mapping to identify detection gaps, prioritize r"

• When deploying or configuring implementing mitre attack coverage mapping capabilities in your environment

• When establishing security controls aligned to compliance requirements

• When building or improving security architecture for this domain

• When conducting security assessments that require this implementation

Prerequisites

• Access to MITRE ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/)
• Inventory of all active SIEM detection rules
• MITRE ATT&CK technique mapping for each detection rule
• Data source inventory (which log sources are ingested)
• Understanding of adversary threat profiles relevant to your industry

Coverage Mapping Process

1. Scope and authorize — confirm written authorization and define target boundaries
2. Reconnaissance — enumerate targets, services, and potential attack surfaces
3. Exploitation — attempt exploitation of identified vulnerabilities within scope
4. Post-exploitation — document access level, lateral movement, and data exposure
5. Report and remediate — compile findings with reproduction steps and fix recommendations

Step 1: Export Current Detection Rules

# Splunk ES - Export all active correlation searches with MITRE mappings
| rest /services/saved/searches
| search disabled=0 action.correlationsearch.enabled=1
| table title, search, action.notable.param.security_domain,
    action.notable.param.severity, action.correlationsearch.annotations
| eval mitre_techniques=mvfilter(match('action.correlationsearch.annotations', "mitre_attack"))