MITRE ATT&CK detection coverage is the ratio of adversary techniques your SOC can detect, validated against the technique set your threat model prioritizes, on the current framework version. A coverage percentage means nothing without its denominator and proof method. Validated coverage counts techniques where a deployed detection rule fires against its required data source, divided […]
The post Measuring MITRE ATT&CK detection coverage: what the percentage counts and what it hides appeared first on SOC Prime.