How to Find and Close MITRE ATT&CK Coverage Gaps in detections.ai

See which MITRE ATT&CK techniques your detection library covers and where gaps remain.

This walkthrough shows how to use MITRE Coverage in detections.ai to review coverage statistics, explore your ATT&CK map, and identify partially covered or uncovered techniques. From there, you can find relevant detections shared by the community and copy the right rule directly into your workspace.

MITRE Coverage is especially useful when your SIEM is synced with detections.ai, giving your team a clearer view of where to focus next.

How to find and close MITRE ATT&CK coverage gaps -

Use it by:

1. Open Detection Library and select MITRE Coverage.
2. Review your coverage percentage, library statistics, recent changes, and MITRE ATT&CK map.
3. Select a technique that is partially covered or not covered.
4. Review the detections already in your library and explore matching rules shared by the community.
5. Open a relevant community detection and review whether it fits your needs.
6. Copy the detection directly into your workspace.
7. Return to MITRE Coverage to see how the new detection changes your coverage map.

This view is especially useful when your SIEM is synced with detections.ai, helping your team identify gaps and prioritize the detections that will improve coverage.