Define the mitigation coverage

Define the mitigation coverage for each mitigation that is associated with a technique so that you gain visibility into how well your organization can prevent the attacks that happen due to a particular technique.

Before you begin

• Role required: sn_ti.admin, sn_si.admin: create, write, delete access
• Role required: sn_ti.read: read access

About this task

The mitigation coverage definitions are used in the overall mitigation and technique coverage mapping. You can use the base system mitigation coverage. The base system mitigation coverage consists of coverage types None, Poor, Fair, Good, Very Good, and Excellent. The base system mitigation coverage is also associated with pre-defined colors, and coverage percentages. You can customize the coverage types (add or remove coverage types), coverage percentages for lower limits and higher limits, and colors, or create your custom mitigation coverage.

The customizations that you make to the coverage types, colors, or percentages are used in the mitigation coverage mapping and also in the heat map.

Procedure

1. Navigate to All > Threat Intelligence > MITRE ATT&CK Administration > Mitigation Coverage Definition.

2. Review the mitigation detection entries and customize the entries for your environment.

**Note:** Ensure that you do not overlap the coverage percentage ranges if you customize the percentage limits \(lower or higher\). For example, if a coverage record has the ranges 0 to 20, then the next consecutive record must have lower limit range of 21 or higher to avoid overlapping the coverage percentage range.

The following illustration shows the mitigation coverage definition list.

1. To add an entry, click New, complete the entries, and click Submit.

2. Technique mitigation coverage definitions
   Define your organization's mitigation coverage so that you can effectively measure and detect specific adversary techniques.

Parent Topic:MITRE-ATT&CK administration

Related topics

Get started with MITRE-ATT&CK framework

Understand the MITRE to STIX data model

Domain separation and MITRE-ATT&CK

Set up the MITRE-ATT&CK framework

Manage matrices

Manage techniques

Manage mitigations

Manage groups

Manage malware

Manage tools

Manage MITRE relationships

Manage CVE and technique mapping

Extend the MITRE-ATT&CK data

Define the data source and detection tool mapping

Define the data source and data component mapping

Define the technique detection coverage

Map your technique detection coverage to a technique

Map your mitigation coverage to a technique

Create and map detection rules

Auto-extract technique rules for importing MITRE-ATT&CK information

Review threat group and MITRE-ATT&CK techniques mapping

Threat group to technique heatmap definition

Review the MITRE-ATT&CK system properties