The matrix
Detections › Coverage shows the MITRE ATT&CK enterprise matrix with every technique marked as covered, covered through sub-techniques only, covered by disabled rules only, or not covered. Hover a cell for the rules; click an uncovered technique to draft a rule for it.
What the colours mean
Sub-technique rules count towards their parent technique. The header of each tactic shows how many rules reach it.
Using it
- Filter by coverage and platform to find the gaps that matter to you.
- For techniques that need a source you are not yet collecting, adding the source is the first step.
- Prioritise the techniques that matter most to your environment.