skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-mitre-attack-coverage-mapping

Maps SIEM detection rules to MITRE ATT&CK techniques to identify coverage gaps.

954|172|Updated Mar 13, 2026
Search Tags:#gap analysis#siem#SoC#detection engineering#mitre attack#detection coverage#attack navigator
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-mitre-attack-coverage-mapping
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-mitre-attack-coverage-mapping
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/soc-operations/implementing-mitre-attack-coverage-mapping
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-mitre-attack-coverage-mapping

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC teams often lack visibility into which MITRE ATT&CK techniques their detection rules actually cover, leaving blind spots that adversaries can exploit. This Skill provides a structured process to export detection rules, score coverage per technique, and prioritize gap remediation.

Core Features & Use Cases

  • Coverage Matrix Building: Export active detection rules from Splunk ES or Microsoft Sentinel and map them into an ATT&CK Navigator layer with per-technique scores.
  • Scoring Framework: Rate each technique 0-100 across data source availability, rule quality, validation status, and enrichment depth.
  • Gap Prioritization & Roadmap: Rank gaps by technique prevalence, impact, and feasibility, then build a quarterly detection engineering roadmap.
  • Use Case: A SOC manager needs to justify budget for new detection engineering. Use this Skill to generate a coverage heatmap showing that only 21% of techniques are detected, with a prioritized list of the top gaps to close.

Quick Start

Map my current Splunk detection rules to MITRE ATT&CK techniques and produce a scored coverage layer for ATT&CK Navigator.

Frequently Asked Questions about implementing-mitre-attack-coverage-mapping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map SIEM detection rules to MITRE ATT&CK techniques?▼

Export active correlation searches from Splunk ES or analytics rules from Microsoft Sentinel, then record each rule's ATT&CK technique annotations in an ATT&CK Navigator layer JSON file with scores and comments per technique.

How do I measure SOC detection coverage against MITRE ATT&CK?▼

Score each technique from 0 to 100 across four dimensions: data source availability, rule quality, validation status, and enrichment. Aggregate scores by tactic to compute coverage percentages and identify techniques with no detection.

What is the ATT&CK Navigator layer format for coverage mapping?▼

A Navigator layer is a JSON file listing techniqueIDs with tactic, color, comment, and numeric score fields. A gradient from red to green visualizes coverage from 0 (no detection) to 100 (validated, enriched detection).

Does this work with Microsoft Sentinel as well as Splunk?▼

Yes. The process includes KQL queries to export Sentinel analytics rules with their MITRE tactic mappings, alongside SPL queries for Splunk ES correlation searches, so both platforms feed the same coverage matrix.

Which ATT&CK techniques should I prioritize when closing detection gaps?▼

Prioritize by multiplying technique prevalence, impact, and feasibility. Common high-priority gaps include T1059 command scripting, T1566 phishing, T1078 valid accounts, and T1055 process injection, which often require Sysmon or EDR data sources.

Why do existing detection rules show as coverage gaps?▼

Rules may be non-functional due to misconfigured data sources, missing log ingestion, or lack of validation. The scoring framework assigns zero validation points to untested rules, surfacing these hidden gaps despite rules existing.

Related Skills

Explore More Software Engineering Skills→
MHaggisMHaggis
471

Data Source Mapper

Map MITRE ATT&CK techniques to data sources across SIEM schemas.

Community
Intermediate
defconxtdefconxt

Purple Team / Adversary Emulation

Orchestrate CALDERA, Atomic Red Team, and CloudGoat for ATT&CK-mapped adversary emulation.

Community
Advanced
jaskaranhundaljaskaranhundal
3

threat-intelligence

Enrich security events by classifying IOCs and mapping behaviors to MITRE ATT&CK techniques.

Community
Advanced
alirezarezvanialirezarezvani
25.3k

red-team

Plans authorized red team engagements using MITRE ATT&CK kill-chain scoring and choke point analysis.

Community
Advanced