implementing-mitre-attack-coverage-mapping

Name: implementing-mitre-attack-coverage-mapping
Availability: InStock
Author: Yenn503

Maps SIEM detection rules to MITRE ATT&CK techniques to identify coverage gaps.

1|1|Updated Apr 3, 2026

Search Tags:#gap analysis #soc #siem #detection engineering #mitre attack #detection coverage #attack navigator

Ready to run

npx skills add https://github.com/Yenn503/Net-Runners --skill implementing-mitre-attack-coverage-mapping-yenn503

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: implementing-mitre-attack-coverage-mapping
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/reporting/implementing-mitre-attack-coverage-mapping
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill implementing-mitre-attack-coverage-mapping-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? SOC teams often lack visibility into which MITRE ATT&CK techniques their detection rules actually cover, leaving blind spots that adversaries can exploit. This Skill provides a structured process to export detection rules, score coverage per technique, and prioritize gap remediation. ## Core Features & Use Cases - Coverage Matrix Building: Export active detection rules from Splunk ES or Microsoft Sentinel and map them into an ATT&CK Navigator layer with per-technique scores. - Scoring Framework: Rate each technique 0-100 across data source availability, rule quality, validation, and enrichment dimensions. - Gap Prioritization & Roadmap: Rank gaps by technique prevalence, impact, and feasibility, then build a quarterly detection engineering roadmap. - Use Case: A SOC manager needs to justify budget for new detection engineering. Use this Skill to generate a color-coded ATT&CK Navigator layer showing that process injection (T1055) has zero coverage, then present a prioritized remediation plan. ## Quick Start Ask the AI to map your current Splunk or Sentinel detection rules against MITRE ATT&CK techniques and produce a scored coverage layer with prioritized gaps.

Frequently Asked Questions about implementing-mitre-attack-coverage-mapping

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map SIEM detection rules to MITRE ATT&CK techniques?▼

Export active correlation searches from Splunk ES or analytics rules from Microsoft Sentinel, then record each rule's ATT&CK technique annotations in an ATT&CK Navigator layer JSON with scores and comments per technique.

How to measure SOC detection coverage against MITRE ATT&CK?▼

Score each technique from 0 to 100 using four dimensions: data source availability, rule quality, validation status, and enrichment. Aggregate scores by tactic to compute coverage percentages and identify techniques with no detection.

What is the ATT&CK Navigator layer format for coverage mapping?▼

A Navigator layer is a JSON file listing techniqueIDs with tactic, color, comment, and score fields, plus a gradient definition. It imports directly into the ATT&CK Navigator web tool to visualize coverage as a heatmap.

Does this work with Microsoft Sentinel and Splunk?▼

Yes, the Skill includes a Splunk SPL query using the rest command to export correlation searches and a KQL approach for Sentinel analytics rules. Both outputs feed the same coverage matrix and scoring process.

Which ATT&CK techniques should SOC teams prioritize first?▼

Prioritize by multiplying technique prevalence, impact, and feasibility. Common high-priority gaps include T1059 command scripting, T1566 phishing, T1078 valid accounts, and T1055 process injection, which often lack required data sources like Sysmon.

Why do detection rules show zero coverage for some techniques?▼

Zero scores typically mean required data sources are not ingested, such as Sysmon EventCode 8/10 for process injection or script block logging for PowerShell. The fix is enabling those log sources before writing rules.