DetectPractice and strategy

Detection coverage board

Score detection coverage across the ATT&CK tactics and your own data sources, and read the per-tactic coverage back as a heat row.

How to use it

Name your data sources: the columns of the board.
For each ATT&CK tactic, mark each source none, partial or tested.
The row pill shows the coverage score for that tactic.
Export the board to target your detection engineering.

This tool reinforces detection and incident response. Your work autosaves to this browser. Use the download buttons on the figure for PNG and PowerPoint.

Data sources

Coverage by tactic

Tap a cell to cycle none, partial, tested.

Reconnaissance

Resource development

Initial access

Execution

Persistence

Privilege escalation

Defence evasion

Credential access

Discovery

Lateral movement

Collection

Command and control

Exfiltration

Impact

Detection coverage board

Detection coverage across ATT&CK tactics and data sources

Detection coverage across ATT&CK tactics and data sources