Define the technique detection coverage

Define the technique detection coverage that your organization must measure and detect specific adversary techniques.

Before you begin

• Role required: sn_ti.admin, sn_si.admin: write access
• Role required: sn_ti.read: read access

About this task

The technique coverage definitions are used in the overall technique detection mapping. You can use the base system technique coverage. The base system technique coverage consists of coverage types None, Poor, Fair, Good, Very Good, and Excellent. The base system technique coverage is also associated with pre-defined colors. You can customize the coverage type entries and colors, or create your own entries. For example, you can modify the base system coverage types to Not Applicable, Partial Coverage, and Complete Coverage. Alternatively, you can also create numerical measures for the coverage types such as 0-25 percent, 25–50 percent, and 50–100 percent. The type of modifications done to the base system coverage are not limited to the examples shared.

The customizations that you make to the coverage type and color are used in the overall technique detection mapping and also in the heat map.

Note: If you modify the base system coverage definition, the Coverage Type icons do not display with the techniques in the heat map. The heat map works as expected when you modify the same fields as the base system's-defined technique detection coverage and coverage colors. However, if you delete existing fields from the overall technique detection coverage, the heat map does not display the coverage type icons.

Procedure

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Administration > Detection Coverage Definition.

2. Review the overall technique detection entries and customize the entries for your environment.

The following illustration shows the Detection Coverage Definition list.

1. To add an entry, click New, complete the entries, and click Submit.

2. MITRE-ATT&CK Scoring definition
   Define your organization's MITRE-ATT&CK scoring system so that you can measure how effectively your organization can detect specific adversary techniques.

Parent Topic:MITRE-ATT&CK administration

Related topics

Get started with MITRE-ATT&CK framework

Understand the MITRE to STIX data model

Domain separation and MITRE-ATT&CK

Set up the MITRE-ATT&CK framework

Manage matrices

Manage techniques

Manage mitigations

Manage groups

Manage malware

Manage tools

Manage MITRE relationships

Manage CVE and technique mapping

Extend the MITRE-ATT&CK data

Define the data source and detection tool mapping

Define the data source and data component mapping

Map your technique detection coverage to a technique

Define the mitigation coverage

Map your mitigation coverage to a technique

Create and map detection rules

Auto-extract technique rules for importing MITRE-ATT&CK information

Review threat group and MITRE-ATT&CK techniques mapping

Threat group to technique heatmap definition

Review the MITRE-ATT&CK system properties