What's changed: Created SC-200 Chapter 3 (Domain 1 last-third: custom detection rules from Defender XDR Advanced Hunting (frequency/response actions/entities); Sentinel analytics rules (scheduled/NRT/threat intelligence/machine learning Fusion) and anomalies; MITRE ATT&CK coverage view for tactics/techniques coverage analysis and identifying detection gaps).
3.3Analyzing coverage with MITRE ATT&CK
Understand using the MITRE ATT&CK matrix to analyze attack-vector coverage from analytics rules and hunting queries, visualizing detection gaps.
To measure "is our detection sufficient" with a common language rather than opinion, Sentinel uses the MITRE ATT&CK matrix.
3.3.1The coverage view and detection gaps
Sentinel’s MITRE ATT&CK coverage view maps active analytics rules and hunting queries to ATT&CK tactics and techniques, visualizing on the matrix how well each attack stage is detected. Analysts find thinly-covered tactic stages and reinforce rules or data sources that detect those techniques. This lets teams discuss detection-engineering priorities in a common language.
Cues: "evaluate analytics-rule/hunting coverage by tactics/techniques and visualize detection gaps" = Sentinel MITRE ATT&CK coverage view. Thin stages = insufficient detection → reinforce rules/data sources. ATT&CK is an evaluation framework, not a detection product itself.
Watch the mix-ups: (1) MITRE ATT&CK (coverage-evaluation framework) vs analytics rules (actual detection). (2) For thin stages, separate "missing data source" from "missing rule" before reinforcing. (3) Coverage reflects only enabled rules/queries—disabled ones do not count.
3.3.2Section summary
- MITRE ATT&CK coverage view = map analytics rules/hunting to tactics/techniques and visualize detection gaps
- Reinforce rules/data sources detecting techniques in thin stages; discuss priorities in a common language
- ATT&CK is an evaluation framework—not a detection product itself
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to visualize how well your analytics rules and hunting queries cover attack tactics/techniques and find detection gaps. Which is best?
Q2. The MITRE ATT&CK coverage view shows a tactic stage is thinly covered. What is the best next step?
Q3. Which correctly characterizes MITRE ATT&CK?
Q4. What is reflected in the coverage view?
Q5. When reinforcing a detection gap, what should you first determine?