The matrix
Detections › Coverage shows the MITRE ATT&CK enterprise matrix with every technique coloured by how many enabled rules reference it in the selected organization. Hover a cell for the rules; click through to them. Uncoloured techniques are where to add rules.
What the colours mean
Colour reflects the number of enabled rules per technique. A technique whose rules lack a data source they need is shown with a warning.
Using it
- Filter to the data sources you have. For techniques that need a source you are not yet collecting, adding the source is the first step.
- Export the matrix as a CSV or attach the picture to a report. Customers ask for it.
- Prioritise the techniques that matter most to your environment.