<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Coverage Analysis & Gap Remediation Reference

Deep reference for ATT&CK detection coverage mapping, DeTT&CT scoring, and gap prioritization.
Parent skill: [../SKILL.md](../SKILL.md)

---

## ATT&CK Coverage Heatmap Generation

### Approach

Map every deployed detection rule to its MITRE ATT&CK technique(s), then overlay on the ATT&CK matrix to visualize coverage density and gaps.

### Data Model

```json
{
  "technique_id": "T1003.001",
  "technique_name": "LSASS Memory",
  "tactic": "credential-access",
  "detections": [
    {
      "rule_id": "sigma-lsass-access-001",
      "rule_title": "Suspicious LSASS Access",
      "data_source": "Sysmon EventID 10",
      "confidence": "high",
      "platform": "windows"
    }
  ],
  "coverage_score": 3,
  "gap_status": "covered"
}
```

### Coverage Scoring Scale

| Score | Label | Definition |
|-------|-------|-----------|
| 0 | None | No detection capability |
| 1 | Minimal | Single low-confidence rule, high FP rate |
| 2 | Partial | Rule exists but limited data sources or narrow scope |
| 3 | Good | Reliable detection with acceptable FP rate |
| 4 | Strong | Multiple correlated detections, low FP, tested |
| 5 | Comprehensive | Layered detection, behavioral + signature, automated response |

### Heatmap Generation Script

```python
"""Generate ATT&CK coverage heatmap from detection inventory."""
import json
from pathlib import Path

from attackcti import attack_client  # pip install attackcti


def load_detection_inventory(path: str) -> dict[str, int]:
    """Load technique_id → coverage_score mapping."""
    inventory = json.loads(Path(path).read_text())
    return {d["technique_id"]: d["coverage_score"] for d in inventory}


def generate_navigator_layer(inventory: dict[str, int], name: str) -> dict:
    """Generate ATT&CK Navigator JSON layer."""
    techniques = []
    for tid, score in inventory.items():
        color_map = {0: "#ffffff", 1: "#ff6666", 2: "#ff9944",
                     3: "#ffdd44", 4: "#88cc44", 5: "#44aa44"}
        techniques.append({
            "techniqueID": tid,
            "score": score,
            "color": color_map.get(score, "#ffffff"),
            "comment": f"Coverage: {score}/5",
            "enabled": True,
        })
    return {
        "name": name,
        "versions": {"attack": "15", "navigator": "5.0", "layer": "4.5"},
        "domain": "enterprise-attack",
        "techniques": techniques,
        "gradient": {"colors": ["#ff6666", "#ffdd44", "#44aa44"], "minValue": 0, "maxValue": 5},
    }
```

### Tools

| Tool | Purpose | Link |
|------|---------|------|
| ATT&CK Navigator | Interactive heatmap visualization | mitre-attack.github.io/attack-navigator |
| DeTT&CT | Automated scoring and comparison | github.com/rabobank-cdc/DeTTECT |
| Vectr | Purple team tracking with coverage | vectr.io |
| sigma-cli | Rule-to-technique mapping via tags | github.com/SigmaHQ/sigma-cli |

---

## DeTT&CT Configuration and Scoring

### Overview

DeTT&CT (Detect Tactics, Techniques & Combat Threats) provides a structured methodology to score detection and data source quality against ATT&CK.

### Data Source Quality Scoring

Rate each log source on five dimensions (0–5 each):

| Dimension | Description | Example (Sysmon) |
|-----------|-------------|-------------------|
| Device completeness | % of assets with the source enabled | 4 (95% coverage) |
| Data field completeness | Fields available vs. needed | 5 (all fields logged) |
| Timeliness | Ingestion latency | 4 (< 2 min avg) |
| Consistency | Format stability across versions | 4 (stable schema) |
| Retention | How long data is stored | 3 (90 days) |

### Detection Quality Scoring

For each technique, score the best detection:

| Score | Definition |
|-------|-----------|
| 0 | No detection |
| 1 | Basic — single data source, high noise |
| 2 | Fair — tuned rule, moderate confidence |
| 3 | Good — validated rule, low FP, tested with emulation |
| 4 | Very good — multiple correlated rules, behavioral analysis |
| 5 | Excellent — real-time, multi-source, automated response |

### DeTT&CT YAML Format

```yaml
# data_sources.yaml
data_sources:
  - data_source_name: Process Creation
    products:
      - windows
    available_for_data_analytics: true
    quality:
      device_completeness: 4
      data_field_completeness: 5
      timeliness: 4
      consistency: 4
      retention: 3

# technique_detection.yaml
techniques:
  - technique_id: T1059.001
    technique_name: PowerShell
    detection:
      - applicable_to: ["windows"]
        score_logtype: process_creation
        detection_score: 3
        comment: "Sigma rule detects encoded commands, obfuscation patterns"
```

---

## Gap Prioritization Using CTI

### Prioritization Framework

Not all ATT&CK gaps are equal. Prioritize by intersection of:

1. **Threat relevance** — techniques used by threat actors targeting your sector
2. **Feasibility** — data sources available to build detection
3. **Impact** — damage potential if technique succeeds undetected

### Prioritization Matrix

```
Priority = Threat_Relevance × Feasibility × Impact

          High Feasibility    Low Feasibility
High      ┌─────────────────┬─────────────────┐
Threat    │  P1 — Fix now   │  P2 — Plan data │
Relevance │  (build rule)   │  (enable source) │
          ├─────────────────┼─────────────────┤
Low       │  P3 — Backlog   │  P4 — Accept    │
Threat    │  (opportunistic)│  (risk accept)  │
Relevance └─────────────────┴─────────────────┘
```

### Sector-Specific Threat Mapping

```python
"""Map threat groups to techniques for a given sector."""
SECTOR_THREAT_MAP = {
    "financial": ["APT38", "FIN7", "FIN12", "Carbanak"],
    "healthcare": ["APT41", "FIN12", "Ryuk operators"],
    "government": ["APT28", "APT29", "Lazarus Group", "Turla"],
    "technology": ["APT41", "LAPSUS$", "Scattered Spider"],
    "energy": ["Sandworm", "TRITON/TRISIS", "Dragonfly"],
}

def get_priority_techniques(sector: str, cti_source) -> list[str]:
    """Return technique IDs used by threat actors targeting sector."""
    groups = SECTOR_THREAT_MAP.get(sector, [])
    techniques = set()
    for group in groups:
        techniques.update(cti_source.get_techniques_by_group(group))
    return sorted(techniques)
```

---

## Coverage Improvement Tracking

### Metrics Dashboard

| Metric | Formula | Target |
|--------|---------|--------|
| Overall coverage % | Techniques scored ≥ 2 / Total techniques | > 60% |
| Critical gap count | P1 techniques with score 0 | 0 |
| Mean detection score | Average score across all mapped techniques | > 2.5 |
| Monthly improvement | New techniques covered this month | > 5 |
| FP rate (weighted) | FP alerts / Total alerts (weighted by severity) | < 10% |

### Quarterly Review Process

1. **Re-run DeTT&CT** with updated detection inventory and data source scores
2. **Overlay new CTI** — check if threat landscape shifted priority techniques
3. **Compare heatmaps** — current quarter vs. previous (Navigator diff layers)
4. **Update roadmap** — promote P2 → P1 where data sources were enabled
5. **Report to leadership** — coverage %, gap trend, top risks remaining
