MITRE ATT&CK coverage mapping without the heat-map theatre
An honest MITRE ATT&CK coverage map starts from the techniques your likely attackers use, and records for each one whether you log it, alert on it, or have tested the alert. A heat map that is green everywhere usually means those three were counted as one.
Why a green heat map misleads
The MITRE ATT&CK matrix is a knowledge base of how real attackers behave. It was never meant as a scorecard. Yet the most common way to present it is a grid coloured by “coverage,” and the goal quietly becomes turning every cell green.
Three things make that grid lie. A technique gets marked covered because a product is capable of seeing it, whether or not your configuration does. One narrow rule turns a whole technique green, even when it catches only one of many variants. And logging, alerting and tested detection all get the same colour.
The result reassures a board and tells your analysts very little.
Where an ATT&CK mapping should start
Start with the threat groups that have a reason to target you, and the techniques they are publicly reported to use. That gives a short list of a few dozen techniques instead of several hundred.
ATT&CK’s own groups pages list the techniques seen in public reporting on each group. Add the ransomware operators active in your sector and anything from your own incidents. Some techniques will never matter to you. Leaving them off the list is a decision, and it should be written down as one.
Logged, alerted, tested: three different answers
Logging means the evidence exists somewhere. Alerting means a rule will raise it to a person. Tested means someone ran the technique and watched the alert fire.
Take credential dumping from memory on a Windows server. You may collect process access events that would show it. That is logged. A rule that fires when an unusual process reads the credential store is alerted. Running a safe emulation of the technique and watching the alert reach the on-call analyst is tested.
The third column is usually much shorter than people expect. That gap tends to be the most useful finding in the exercise.
How to present ATT&CK coverage honestly
Report it against the short list, with the three levels shown separately, and name the gaps you are choosing to accept. A percentage of the whole matrix tells a board nothing it can act on.
A simple table works better than a heat map: technique, why it is on the list, logged, alerted, tested, and the owner of the next step. Keep prevention in a separate column. A technique blocked on every endpoint needs less detection effort than one that is merely watched.
Show the trend, not just the snapshot. “Tested detections for our short list went from six to fourteen this year” is a sentence a board can hold you to.
Where the detections come from
Most gaps close in one of two ways: a missing log source is turned on, or a rule is written and tuned against real data. Which platform holds the rules matters less than whether anyone tests them; the options are compared in Splunk vs Sentinel vs Elastic vs Graylog. Proving a detection fires is the job of adversary simulation.
Questions we are asked
Is a fully green ATT&CK heat map a good sign?
Usually not. It often means logging, alerting and tested detection were counted as the same thing, or that techniques were marked covered because a product claims them.
What is the difference between logging, alerting and tested coverage?
Logging means the evidence exists somewhere. Alerting means a rule will raise it to a person. Tested means someone ran the technique and watched the alert fire.
Where should an ATT&CK mapping start?
Start with the threat groups that have a reason to target you, and the techniques they are publicly reported to use. That gives a short list of a few dozen techniques instead of several hundred.
How should ATT&CK coverage be reported to leadership?
Report it against the short list, with the three levels shown separately, and name the gaps you are choosing to accept. A percentage of the whole matrix tells a board nothing it can act on.
Getting an honest map of your coverage
We map coverage against your likely adversaries as part of MITRE ATT&CK threat-informed defence, and hand the gaps to detection engineering. More pieces are indexed at writing.