What's changed: Created SC-200 Chapter 3 (Domain 1 last-third: custom detection rules from Defender XDR Advanced Hunting (frequency/response actions/entities); Sentinel analytics rules (scheduled/NRT/threat intelligence/machine learning Fusion) and anomalies; MITRE ATT&CK coverage view for tactics/techniques coverage analysis and identifying detection gaps).
3.3Analyzing coverage with MITRE ATT&CK
Understand using the MITRE ATT&CK matrix to analyze attack-vector coverage from analytics rules and hunting queries, visualizing detection gaps.
To measure "is our detection sufficient" with a common language rather than opinion, Sentinel uses the MITRE ATT&CK matrix.
3.3.1The coverage view and detection gaps
Sentinel’s MITRE ATT&CK coverage view maps active analytics rules and hunting queries to ATT&CK tactics and techniques, visualizing on the matrix how well each attack stage is detected. Analysts find thinly-covered tactic stages and reinforce rules or data sources that detect those techniques. This lets teams discuss detection-engineering priorities in a common language.
Cues: "evaluate analytics-rule/hunting coverage by tactics/techniques and visualize detection gaps" = Sentinel MITRE ATT&CK coverage view. Thin stages = insufficient detection → reinforce rules/data sources. ATT&CK is an evaluation framework, not a detection product itself.
Watch the mix-ups: (1) MITRE ATT&CK (coverage-evaluation framework) vs analytics rules (actual detection). (2) For thin stages, separate "missing data source" from "missing rule" before reinforcing. (3) Coverage reflects only enabled rules/queries—disabled ones do not count.
3.3.2Section summary
- MITRE ATT&CK coverage view = map analytics rules/hunting to tactics/techniques and visualize detection gaps
- Reinforce rules/data sources detecting techniques in thin stages; discuss priorities in a common language
- ATT&CK is an evaluation framework—not a detection product itself
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to visualize how well your analytics rules and hunting queries cover attack tactics/techniques and find detection gaps. Which is best?
Q2. The MITRE ATT&CK coverage view shows a tactic stage is thinly covered. What is the best next step?
Q3. Which correctly characterizes MITRE ATT&CK?
Q4. What is reflected in the coverage view?
Q5. When reinforcing a detection gap, what should you first determine?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.